Loading vulnerability…
Unauthenticated Arbitrary File Upload in Extensions For CF7
CVE-2026-94589 is an arbitrary file upload vulnerability in the Extensions For CF7 WordPress plugin affecting all versions through 3.4.5. The extcf7_submit function processes signature-field uploads whose validation_filter() lacks file extension, MIME type, and size validation. A sanitize_file_name() bypass can transform a crafted filename into one with an executable PHP extension. Combined with missing PHP-execution guards in the upload directory, these weaknesses allow unauthenticated attackers to upload potentially executable files and may enable remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated attackers can upload potentially executable files to the affected WordPress installation. If the server executes uploaded PHP files, successful exploitation can result in remote code execution. Specific consequences for data confidentiality, service availability, or other systems are not established.
If you can’t patch tonight, do this now.
Configure upload directories to prevent PHP execution and enforce file extension, MIME type, and size validation for signature-field uploads. Ensure filename sanitization cannot produce an executable extension or bypass the upload restrictions.
Patch, then assume compromise.
Update Extensions For CF7 to a release that addresses the upload vulnerability. No specific fixed version is identified, and all versions through 3.4.5 are affected; verify that the selected release includes the fix rather than assuming the latest available release is safe.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.