{"metadata": {"vulnerability": "CVE-2026-94589", "count": 19, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-21T20:57:21.736Z", "date_only": false, "value": "2026-09-21T20:57:21.736Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-94589", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-21T21:12:37Z", "date_only": false, "value": "2026-09-21T21:12:37.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-94589", "field": "containers.cna.timeline.0.time", "text": "Vendor Notified"}, {"timestamp": "2026-10-09T15:24:50Z", "date_only": false, "value": "2026-10-09T15:24:50.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-94589", "field": "containers.cna.timeline.1.time", "text": "Disclosed"}, {"timestamp": "2026-10-10T03:26:46.082Z", "date_only": false, "value": "2026-10-10T03:26:46.082Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94589", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-10T03:26:46.082Z", "date_only": false, "value": "2026-10-10T03:26:46.082Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-94589", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-10T03:48:37.170Z", "date_only": false, "value": "2026-10-10T03:48:37.170575Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117414567377776643", "record": "CVE-2026-94589", "field": "creation_timestamp", "uuid": "f16a00fc-c56a-4e14-ac08-46446508da6d", "content": "CVE-2026-94589 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94589https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3193c4-dd3e-4d9e-be42-769c7358beae?source=cvehttps://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.form-data-store.php#L42https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L222https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L82https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.cf7-extensions.php#L289https://plugins.trac.wordpress.org/changeset?reponame=&new=3727009%40extensions-for-cf7%2Ftags%2F3.4.6&old=3672142%40extensions-for-cf7%2Ftags%2F3.4.5https://plugins.trac.wordpress.org/changeset/3727009/extensions-for-cf7/trunk/admin/include/class.cf7-signature.php#wordpress #htplugins #ExtensionsForCF7(Contactform7Database,ConditionalFieldsandRedirection)#CVE_2026_94589#bot", "url": "https://infosec.exchange/users/cve/statuses/117414567377776643"}, {"timestamp": "2026-10-10T04:18:19Z", "date_only": false, "value": "2026-10-10T04:18:19Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FJHX-3CM7-WHVF", "record": "GHSA-FJHX-3CM7-WHVF", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-10T04:18:19.713Z", "date_only": false, "value": "2026-10-10T04:18:19.713", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94589", "record": "FKIE_CVE-2026-94589", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-10T04:30:25.999Z", "date_only": false, "value": "2026-10-10T04:30:25.999364Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117414731792998689", "record": "cve-2026-94589", "field": "creation_timestamp", "uuid": "f99422b7-e78b-4e14-a5ae-9a78e6393b08", "content": "CVE-2026-94589: CRITICAL RCE in Extensions For CF7 (<=3.4.5) for WordPress. Unauth attackers can upload and run malicious files \u2014 full compromise possible. Restrict uploads, monitor activity, and check for fixes. https://radar.offseq.com/threat/cve-2026-94589-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-htplugins-extensions-for-cf7-1b07904cb30ec057 #OffSeq #WordPress #CVE202694589 #infosec", "url": "https://infosec.exchange/users/offseq/statuses/117414731792998689"}, {"timestamp": "2026-10-10T04:30:28.426Z", "date_only": false, "value": "2026-10-10T04:30:28.426639Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxinqd22de2l", "record": "cve-2026-94589", "field": "creation_timestamp", "uuid": "13112398-9ff2-4ce7-8c8a-a6926ee94282", "content": "CVE-2026-94589 (CRITICAL): Extensions For CF7 (<=3.4.5) lets unauth attackers upload & execute files on WordPress. Restrict uploads & monitor for suspicious files. Patch status: unknown. https://radar.offseq.com/threat/cve-2026-94589-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-htpl...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxinqd22de2l"}, {"timestamp": "2026-10-10T06:07:34.660Z", "date_only": false, "value": "2026-10-10T06:07:34.660886Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxit5yfbs52l", "record": "CVE-2026-94589", "field": "creation_timestamp", "uuid": "94eb6f0c-7caf-41ce-bcd8-8583ab77f02b", "content": "\ud83d\udea8 CVE-2026-94589 \u2014 CVSS 9.8 CRITICAL\n\nThe Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress i...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-94589\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxit5yfbs52l"}, {"timestamp": "2026-10-10T06:10:05.730Z", "date_only": false, "value": "2026-10-10T06:10:05.730226Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxitcidj3e2h", "record": "CVE-2026-94589", "field": "creation_timestamp", "uuid": "0182e7c1-17c9-4cb9-81a5-fb5b5e88c64e", "content": "CVE-2026-94589\nAll versions of the Extensions for CF7 (Contact Form 7 Database, Conditional Fields and Redirection) plugin for WordPress let anyone upload files without proper checks. This could let a malicious file run on\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxitcidj3e2h"}, {"timestamp": "2026-10-10T06:30:57Z", "date_only": false, "value": "2026-10-10T06:30:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FJHX-3CM7-WHVF", "record": "GHSA-FJHX-3CM7-WHVF", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-10T06:30:57Z", "date_only": false, "value": "2026-10-10T06:30:57Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FJHX-3CM7-WHVF", "record": "GHSA-FJHX-3CM7-WHVF", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-11T16:43:32.558Z", "date_only": false, "value": "2026-10-11T16:43:32.558627Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94589", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-11T16:43:32.558Z", "date_only": false, "value": "2026-10-11T16:43:32.558627Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94589", "record": "FKIE_CVE-2026-94589", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-11T16:55:19.810Z", "date_only": false, "value": "2026-10-11T16:55:19.810Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-94589", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T16:55:19.810Z", "date_only": false, "value": "2026-10-11T16:55:19.810Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94589", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T13:29:12.567Z", "date_only": false, "value": "2026-10-13T13:29:12.567", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94589", "record": "FKIE_CVE-2026-94589", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-06T12:07:51.603Z", "anchors": {"origin": {"timestamp": "2026-10-10T03:26:46.082Z", "date_only": false, "value": "2026-10-10T03:26:46.082Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94589", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-10T03:26:46.082Z", "date_only": false, "value": "2026-10-10T03:26:46.082Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94589", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2364065.521191, "hours": 656.6848669975, "days": 27.361869458229165, "min_seconds": 2364065.521191, "max_seconds": 2364065.521191, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-10T03:26:46.082Z", "date_only": false, "value": "2026-10-10T03:26:46.082Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94589", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T12:07:51.603Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}