VulnSocial

CVE-2026-94589

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-10: 110-10
Referenced assets1 URL
Full discourse1 post
  • ♫Why♥Not♪@Python_s_

    #NØØT_Security_Alerts 🚨 #ALERT — CRITICAL WORDPRESS EXTENSIONS FOR CF7 FLAW ENABLES UNAUTHENTICATED PHP UPLOAD AND POTENTIAL RCE October 9, 2026 PRODUCT: Extensions For CF7 — WordPress Plugin CVE: CVE-2026-94589 SEVERITY: Critical — CVSS 9.8 AFFECTED VERSIONS: 3.4.5 and earlier. Fixed in 3.4.6. IMPACT: Unauthenticated attackers can upload potentially executable PHP files through vulnerable signature-field processing. Insufficient file validation and missing PHP-execution protections may enable remote code execution on affected WordPress servers. EXPLOITATION STATUS: CONFIRMED VULNERABILITY. Research identifies a filename-sanitization bypass. Active malicious exploitation remains unverified. Forensic triage: Inspect suspicious extcf7_submit requests. Search upload directories for unexpected PHP files, suspicious filename extensions, and unauthorized web-server processes. URGENT ACTION: Update Extensions For CF7 to version 3.4.6 or later. Restrict vulnerable form functionality until patched. Block PHP execution in upload directories and investigate historical suspicious uploads. SOURCE: https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3193c4-dd3e-4d9e-be42-769c7358beae?source=cve CONFIDENCE: HIGH — Wordfence vulnerability research and documented upstream remediation. #CyberSecurity #ThreatIntel #WordPress #RCE #FileUpload #WebSecurity #NØØT.

    0000049
    231 followersView on X

Explore more

Back to dashboard