Critical WordPress Plugin Flaw Allows Unauthenticated Remote Code Execution

A critical security vulnerability in the Extensions For CF7 WordPress plugin allows unauthenticated attackers to execute arbitrary code on affected websites. The flaw, identified as CVE-2026-94589, has been assigned a CVSS score of 9.8, indicating a severe risk to any site using the compromised software.

At a glance

CVE

CVE-2026-94589

Product

htplugins Extensions For CF7 (Contact form 7 Database, Condi

CVSS

9.8 Critical

Weakness

unrestricted file upload

Exploited

No known exploitation

According to the National Vulnerability Database (NVD), the vulnerability stems from insufficient validation controls within the plugin’s `extcf7_submit` function. Specifically, the `validation_filter()` associated with the signature field fails to properly validate file extensions, MIME types, and file sizes.

This lack of validation is compounded by the absence of PHP-execution guards in the upload directory, which allows uploaded files to be processed by the server. Furthermore, the vulnerability includes a bypass of the `sanitize_file_name()` function, which normally strips dangerous characters. Attackers can exploit this by naming a malicious file `shell.php-`, which the system converts to `shell.php`, resulting in an executable file.

Technical Details and Impact

The combination of missing input validation and inadequate server-side protections creates a direct path to remote code execution (RCE). Because the vulnerability exists in the `extcf7_submit` function, attackers do not need valid user credentials to exploit it. This unauthenticated access vector significantly increases the attack surface, allowing threat actors to target any public-facing WordPress site running the vulnerable plugin.

The underlying weakness is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). By uploading a PHP shell, an attacker can take full control of the web server, potentially stealing data, modifying content, or using the server as a pivot point for further attacks within a network. The NVD record confirms that all versions of the Extensions For CF7 plugin up to and including version 3.4.5 are affected.

Affected Software

The vulnerability impacts the "Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)" plugin developed by htplugins. This plugin is designed to enhance the functionality of Contact Form 7, a widely used WordPress form builder. Because Contact Form 7 is installed on millions of websites, plugins that extend its capabilities are also prevalent. Site administrators who have installed version 3.4.5 or earlier of the Extensions For CF7 plugin are currently exposed to this critical risk.

No official patch or fix has been confirmed yet in the available source material. Users are advised to monitor vendor announcements for security updates.

What should you do?

Site administrators should immediately audit their WordPress installations to determine if the Extensions For CF7 plugin is present. If the plugin is installed and not actively used, the most effective immediate mitigation is to deactivate and delete it. For sites that require the plugin’s functionality, administrators should check for updates from the vendor htplugins. Until a fix is released, restricting access to the upload directories at the server level can help mitigate the risk, though this may impact legitimate form submissions.

What to do and how to stay safe: WordPress

• Identify if the Extensions For CF7 plugin is installed on your WordPress site by checking the plugin list in the admin dashboard.
• If the plugin is not essential to your site’s operations, deactivate and delete it immediately to eliminate the vulnerability.
• Monitor official channels from htplugins for the release of a patched version of the software.
• Review server logs for any suspicious file uploads or unusual activity in the plugin’s upload directory.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-94589?

CVE-2026-94589 is a critical vulnerability in the Extensions For CF7 WordPress plugin that allows unauthenticated attackers to upload executable files and execute remote code.

Which versions of the plugin are affected?

All versions of the Extensions For CF7 plugin up to and including 3.4.5 are vulnerable to this exploit.

Is authentication required to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to exploit the flaw, meaning no login credentials are necessary.