CVE-2026-94589

Summary

The Contact Form 7 Extensions plugin allows unauthenticated attackers to upload arbitrary files, including potentially executable ones, due to insufficient validation of uploaded files and a sanitize_file_name() bypass that converts shell.php- into shell.php. This vulnerability can lead to remote code execution on the affected WordPress site.

Exploitability

Exploitation is straightforward for unauthenticated attackers with no preconditions required, as the vulnerability exists in a publicly accessible endpoint that accepts file uploads without authentication.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the WordPress server, potentially leading to full compromise of the web application and underlying infrastructure.

Detection

Monitor for unusual file upload activity in the wp-content/uploads directory, particularly files with executable extensions like .php, .phtml, or .phar that appear without user interaction.

Prioritized remediation

Upgrade to version 3.4.6 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.