Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) vulnerabilities

2 known vulnerabilities in Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) from Htplugins. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Extensions For CF7 (Contact form 7 Database…: Unrestricted Upload of File with Dangerous Type

  CVE-2026-94589Oct 10, 2026Htplugins

  The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension,

• 8.1 High severity

  Extensions For CF7 (Contact form 7 Database…: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-7645Jul 22, 2025Htplugins

  The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete-file' field in all versions up to, and including, 3.2.8.