Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion

The primary impact of CVE-2025-7645 is the potential for remote code execution (RCE). An attacker can exploit this vulnerability by crafting a malicious request to delete critical files, such as wp-config.php. Successful deletion of wp-config.php would grant the attacker complete control over the WordPress installation, allowing them to modify content, install malware, or compromise the entire system. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of attackers. This vulnerability shares similarities with other file deletion vulnerabilities where the deletion of core configuration files can lead to full system compromise.

WordPress websites utilizing the Extensions For CF7 plugin, particularly those running older versions (0.0.0–3.2.8), are at significant risk. Shared hosting environments where users have limited control over plugin updates are especially vulnerable. Websites with weak server configurations or inadequate access controls are also at increased risk.

• wordpress / composer / npm:

grep -r 'delete-file' /var/www/html/wp-content/plugins/extensions-for-cf7/

• wordpress / composer / npm:

wp plugin list | grep 'Extensions For CF7'

• wordpress / composer / npm:

wp plugin update extensions-for-cf7 --version=3.2.9

• generic web: Check WordPress plugin directory for outdated versions of Extensions For CF7.

1. 2025-07-22Disclosure

   disclosure

1. Reserviert2025-07-14
2. Veröffentlicht2025-07-22
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-7645 is to immediately upgrade the Extensions For CF7 plugin to version 3.2.9 or later. If upgrading is not immediately possible due to compatibility issues or breaking changes, consider restricting file access permissions on the WordPress server to limit the potential damage from a successful exploit. Implement a Web Application Firewall (WAF) with rules to block suspicious file deletion requests targeting the plugin's endpoints. Regularly review WordPress plugin installations and remove any unused or outdated plugins to reduce the attack surface. After upgrading, verify the fix by attempting to delete a test file through the plugin's interface and confirming that the deletion fails.

Aktive Installationen

6KBekannt

Plugin-Bewertung