Extensions For CF7

CVE-2026-94589 is a critical unauthenticated file-upload flaw in Extensions For CF7 3.4.5 and earlier. Update to 3.4.6 immediately.

CVE-2026-94589 is a critical unauthenticated arbitrary file-upload vulnerability in Extensions For CF7. A remote attacker can reach the vulnerable signature-field upload path without logging in and may be able to place a server-executable file, leading to remote code execution and full site compromise.

Table of Contents

Affected versions and severity

Plugin: Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
Affected: 3.4.5 and earlier
Fixed: 3.4.6
CVE: CVE-2026-94589
Severity: Critical, CVSS 9.8
Privileges required: None
Attack class: Unrestricted upload of a dangerous file type (CWE-434)

Exploit path

The vulnerable extcf7_submit flow processes files from the plugin’s signature field. Versions through 3.4.5 do not adequately validate the uploaded file extension, MIME type, or size. The affected upload directory also lacks a reliable PHP-execution guard, while filename sanitization can remove a crafted trailing character and leave an executable extension.

No account or administrator interaction is required. On a server that executes PHP from the resulting upload location, a successful upload can become remote code execution. Version 3.4.6 hardens signature-field and submission-storage upload handling.

Immediate remediation

Update Extensions For CF7 to 3.4.6 or later.
Confirm the new version is active and purge WordPress, server, and CDN caches.
If the update cannot be applied immediately, deactivate the plugin or remove affected signature fields from every public form until the patch is installed.
Block PHP execution in upload directories as defense in depth.
Audit recent uploads and web logs before considering the incident closed.

Verify the plugin version

wp plugin get extensions-for-cf7 --fields=name,version,status

Check for suspicious uploaded files

The following read-only filesystem check lists common server-executable extensions under WordPress uploads. Investigate every result; do not delete files until they have been preserved and reviewed.

find wp-content/uploads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.php5' \) -print

Temporary web-server hardening

Apache sites can deny PHP-like files inside wp-content/uploads with a local .htaccess rule:

<FilesMatch "\.(php|phtml|phar|php[0-9]*)$">
  Require all denied
</FilesMatch>

For Nginx, add an equivalent rule in the server configuration and reload only after validating the configuration:

location ~* ^/wp-content/uploads/.*\.(php|phtml|phar|php[0-9]*)$ {
    deny all;
}

These controls reduce execution risk but do not replace updating the vulnerable plugin.

Indicators to review

Unexpected PHP-like files in uploads or plugin-managed submission directories.
Anonymous requests to public Contact Form 7 forms containing signature data followed by direct requests to a newly created file.
New administrator accounts, unfamiliar scheduled tasks, modified plugin files, or outbound connections after a suspicious form submission.
Web-server processes writing executable files beneath public upload paths.

Exploitation status

No confirmed exploitation in the wild was cited by the authoritative sources reviewed, and CVE-2026-94589 was not found in the CISA Known Exploited Vulnerabilities catalog at review time. Patchstack rates the issue as high priority and warns that vulnerabilities of this type are commonly used in mass-exploitation campaigns.

Sources

This advisory is based on disclosures from Wordfence, Patchstack, WPScan, the CVE Program, and the plugin vendor. WPDeeply did not discover this vulnerability.