Extensions For CF7 WordPress plugin: Unauthenticated arbitrary file upload

Summary

The Extensions For CF7 plugin for WordPress up to and including version 3.4.5 lets unauthenticated attackers upload files through the signature field. Missing file extension, MIME type and size validation, the absence of PHP execution guards in the upload directory, and a file name sanitization bypass allow executable files such as PHP scripts to be uploaded. A successful upload can lead to remote code execution and full compromise of the website, possibly the hosting account. The NVD base score is 9.8 (critical).

Affected

• Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) WordPress plugin, all versions up to and including 3.4.5
• Exploitation requires a form that uses the signature field (inference from the description)

Fixed in

• Version 3.4.6 according to WPScan and the vendor SVN changeset; not yet confirmed on the WordPress.org changelog. Verify the fixed version before relying on it.

Workaround

• Deactivate or remove the plugin, or remove the signature field from forms
• Configure the web server to deny PHP execution in the plugin's upload directories
• Use a WAF to block executable file types on form endpoints

Exploitation

• CISA KEV: not listed. EPSS: unknown.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No public proof of concept or in-the-wild exploitation found at the time of research.

Our recommendation

• Update the plugin to version 3.4.6 or later after verifying the fix version on WordPress.org.
• If patching is delayed, deny PHP execution in the upload directories and remove the signature field from forms first.
• Check the plugin's upload directories for unexpected or executable files and review web server logs for suspicious requests.
• Treat this as high priority for any public WordPress site with the plugin installed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• NVD / CVE record via Wordfence www.wordfence.com
• Vendor SVN changeset 3.4.6 vs 3.4.5 plugins.trac.wordpress.org
• WordPress.org plugin page wordpress.org
• WPScan plugin page wpscan.com
• Freshysites security bulletin freshysites.com
• ionix.io threat center www.ionix.io
• VulDB entry for extcf7_submit vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:02.