External risk intelligence

WordPress CF7 Plugin Arbitrary File Upload leads to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-94589

This vulnerability exists in a WordPress plugin designed to handle contact form submissions. Contact forms are public-facing features by design, intended to be accessed and used by internet users to interact with a website. Because this plugin processes submissions directly from the public internet, the vulnerable endpoint is inherently exposed.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin used for handling contact form submissions. This issue allows unauthenticated attackers to potentially upload and execute malicious files, which could lead to remote code execution on affected systems. The main concern is confirming relevance and exposure within our WordPress environments.

Unauthenticated attackers can upload executable files.
Critical vulnerability in a widely used WordPress plugin.
Confirm exposure and assess relevance to our systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload malicious files to a WordPress site by exploiting a flaw in a contact form plugin. This is possible because the plugin improperly validates file extensions, MIME types, and file sizes when users submit information through a signature field, and it fails to prevent PHP code execution in the upload directory. By uploading a specially crafted file, an attacker could achieve remote code execution on the server.

Publicly accessible contact form.
Uploading a malicious file via signature field.
Remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to upload and execute arbitrary files on a WordPress site. This could lead to the compromise of the site's integrity and availability.

Potentially executable files.
Through a vulnerable file upload function.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in a WordPress plugin affects how contact form submissions are handled, making it a concern for website owners, platform administrators, and security teams responsible for maintaining the integrity of public-facing web applications. The immediate priority is to locate all instances of the affected plugin, assess their exposure and business criticality, and identify the specific teams or individuals accountable for the WordPress environment to initiate a coordinated remediation or mitigation plan.

Own: Website and platform owners.
Verify: Plugin reachability and asset criticality.
Action: Plan and execute targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Extensions For CF7 plugin used for?

This WordPress plugin adds extra functionality to the popular Contact Form 7 plugin. It expands standard form capabilities by including tools for managing database entries, creating conditional fields, and handling form redirects. It is commonly installed to manage complex user interactions and data collection on WordPress sites.

How would you describe the vulnerability in CVE-2026-94589?

This is an Unrestricted Upload of File with Dangerous Type, categorized as CWE-434. In simple terms, the plugin fails to check if a file being uploaded is actually an image or document. Because it also lacks security rules to stop the server from running uploaded code, an attacker can upload a malicious script that the server will execute.

Can an attacker trigger this bug without being logged in?

Yes. The vulnerability is triggered through a specific signature field on a form, and it does not require the attacker to have an account or administrative access to the website. Note that simply viewing a page with a form does not trigger the bug; it requires the successful submission of a specially crafted, malicious file through that form's signature field.

Is my website at risk from this CVE?

If you use this plugin, your risk is high because of how the software functions. Halo Surface Signal identifies this as 'Very likely' to be exposed because the plugin is designed to process submissions directly from the public internet. Since contact forms are inherently internet-facing features, the vulnerable endpoint is exposed to anyone who can access your site.

What should I do if I am running this plugin?

You should prioritize auditing your WordPress installations to see if you are using this plugin. Check for available security updates that resolve these file validation errors. If an update is not immediately available, consider disabling the form functionality that utilizes this plugin until you can apply a patch or move to a more secure configuration.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.