CVE-2026-94589

Published 10 October 2026 · tracked since 10 October 2026

Description

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the si

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-103889 CRITICAL 9.8
• CVE-2026-104021 HIGH 7.2
• CVE-2026-104735 MEDIUM 6.4
• CVE-2026-102401 MEDIUM 6.4
• CVE-2026-96743 MEDIUM 6.4
• CVE-2026-107645 CRITICAL 9.1
• CVE-2026-104732 CRITICAL 9.8
• CVE-2026-104797 HIGH 8.1
• CVE-2026-104898 MEDIUM 6.8
• CVE-2026-93883 MEDIUM 6.4

→ Open the live CVE board · all tools