Extensions For CF7 EUVD-2026-96041

Exploitation requires the target WordPress site to run Extensions For CF7 version 3.4.5 or earlier AND to have a Contact Form 7 form that uses the plugin's signature field, since the flaw lives in that field's validation_filter() reached through the extcf7_submit function. The attack succeeds against such configurations because file extension, MIME type, and size validation are all missing, the upload directory lacks PHP-execution guards, and sanitize_file_name() can be bypassed (shell.php- becomes shell.php); no authentication (PR:N) and no user interaction (UI:N) are needed. The main limiting factor is that a form must actually expose the signature field and the server must be configured to execute PHP in the upload path - sites not using the signature feature are not exposed via this vector.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact, which is fully consistent with the CWE-434 arbitrary-file-upload-to-RCE described: a signature field's validation_filter() lacks extension, MIME, and size checks, the upload directory has no PHP-execution guard, and a sanitize_file_name() bypass restores 'shell.php-' to 'shell.php'. All three preconditions chain into unauthenticated webshell execution, so the technical impact rating is well supported. The key tempering signals are the absence of hard exploitation data: no EPSS score was supplied, the vulnerability is NOT on CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation yet. No SSVC decision record was provided. Net: treat as urgent patching priority because the flaw class (unauthenticated file upload in a WordPress plugin) is historically a prime target for mass automated scanning once a POC emerges, but current real-world exploitation is unconfirmed rather than demonstrated.

An unauthenticated attacker locates a WordPress site running Extensions For CF7 <= 3.4.5 with a Contact Form 7 form that uses the signature field, then submits the form via the extcf7_submit function with a malicious PHP file named to bypass sanitize_file_name() (e.g. 'shell.php-'). Because extension, MIME, and size validation are missing and the upload directory has no PHP-execution guard, the file lands as an executable 'shell.php' and the attacker requests its URL to run arbitrary code. No public exploit is identified at time of analysis, but the bug class is trivially weaponizable.