{"vulnerability": "CVE-2026-94589", "sightings": [{"uuid": "f16a00fc-c56a-4e14-ac08-46446508da6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94589", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117414567377776643", "content": "CVE-2026-94589 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94589https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3193c4-dd3e-4d9e-be42-769c7358beae?source=cvehttps://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.form-data-store.php#L42https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L222https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L82https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.cf7-extensions.php#L289https://plugins.trac.wordpress.org/changeset?reponame=&new=3727009%40extensions-for-cf7%2Ftags%2F3.4.6&old=3672142%40extensions-for-cf7%2Ftags%2F3.4.5https://plugins.trac.wordpress.org/changeset/3727009/extensions-for-cf7/trunk/admin/include/class.cf7-signature.php#wordpress #htplugins #ExtensionsForCF7(Contactform7Database,ConditionalFieldsandRedirection)#CVE_2026_94589#bot", "creation_timestamp": "2026-10-10T03:48:37.170575Z"}, {"uuid": "f99422b7-e78b-4e14-a5ae-9a78e6393b08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94589", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117414731792998689", "content": "CVE-2026-94589: CRITICAL RCE in Extensions For CF7 (<=3.4.5) for WordPress. Unauth attackers can upload and run malicious files \u2014 full compromise possible. Restrict uploads, monitor activity, and check for fixes. https://radar.offseq.com/threat/cve-2026-94589-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-htplugins-extensions-for-cf7-1b07904cb30ec057 #OffSeq #WordPress #CVE202694589 #infosec", "creation_timestamp": "2026-10-10T04:30:25.999364Z"}, {"uuid": "13112398-9ff2-4ce7-8c8a-a6926ee94282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94589", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxinqd22de2l", "content": "CVE-2026-94589 (CRITICAL): Extensions For CF7 (<=3.4.5) lets unauth attackers upload & execute files on WordPress. Restrict uploads & monitor for suspicious files. Patch status: unknown. https://radar.offseq.com/threat/cve-2026-94589-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-htpl...", "creation_timestamp": "2026-10-10T04:30:28.426639Z"}, {"uuid": "94eb6f0c-7caf-41ce-bcd8-8583ab77f02b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94589", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxit5yfbs52l", "content": "\ud83d\udea8 CVE-2026-94589 \u2014 CVSS 9.8 CRITICAL\n\nThe Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress i...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-94589\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T06:07:34.660886Z"}, {"uuid": "0182e7c1-17c9-4cb9-81a5-fb5b5e88c64e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94589", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxitcidj3e2h", "content": "CVE-2026-94589\nAll versions of the Extensions for CF7 (Contact Form 7 Database, Conditional Fields and Redirection) plugin for WordPress let anyone upload files without proper checks. This could let a malicious file run on\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-10T06:10:05.730226Z"}]}