Introduction
Deleting the wrong file on a WordPress server can take a site down instantly or open the door to remote code execution. The Extensions For CF7 plugin, which adds features to Contact Form 7 forms, recently became a critical risk for any site running versions up to and including 3.2.8. An unauthenticated attacker can arrange for arbitrary files to be deleted, and a single admin click triggers the deletion.
About the involved software: htplugins develops Extensions For CF7 as an extension to Contact Form 7, one of the most widely used WordPress form plugins, with millions of active installations. The plugin adds database, conditional logic, and redirection features to CF7, which makes it popular with site owners who need advanced form workflows. Its user base is smaller than core CF7's but still significant, with thousands of production WordPress sites, so a flaw in this plugin can affect a large portion of the WordPress ecosystem.
Technical Information
The vulnerability affects all versions of Extensions For CF7 up to and including 3.2.8. The root cause is that the plugin does not properly validate or sanitize the file path supplied in the delete-file field. When an administrator deletes a form submission, the plugin reads this field and tries to delete the named file from the server. Nothing checks that the path is safe or stays inside the intended directories.
An attacker can submit a form with a payload like:
../../../wp-config.php
When an administrator later deletes that submission from the backend, the plugin follows the malicious path and deletes the target file. An attacker can use this to remove critical files such as wp-config.php, .htaccess, or any other file the web server process can access. The attack needs no authentication. It rides on the legitimate admin workflow, and because an authorized user action performs the deletion, it is difficult to detect in the logs.
Attack flow:
- Attacker submits a form with a malicious
delete-filevalue (e.g.,../../../wp-config.php). - Administrator reviews and deletes the submission from the WordPress dashboard.
- The plugin processes the unvalidated path and deletes the specified file.
The result can be an immediate site outage, lost configuration, or even remote code execution if attackers can take control of the environment once security-critical files are gone.
Patch Information
For the Server-Side Request Forgery (SSRF) vulnerability identified in versions up to and including 3.2.0 of the Extensions For CF7 plugin, the developers released version 3.2.1 with a security patch. The update adds strict validation and sanitization of user input, which mitigates the risk of unauthorized server requests.
The main change is a whitelist of permitted URLs and protocols, so the plugin processes only safe, intended requests. By limiting which inputs it accepts, the update stops attackers from using the SSRF vulnerability to send arbitrary requests to internal or external servers.
Users and administrators must update Extensions For CF7 to version 3.2.1 or later to get this fix. Updating plugins and themes regularly is basic practice for keeping WordPress sites secure and intact.
Patch source:
Affected Systems and Versions
- Product: Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection)
- Affected versions: All versions up to and including 3.2.8
- Vulnerable configurations: Any WordPress site with the vulnerable plugin version installed and active
Vendor Security History
htplugins, the vendor behind Extensions For CF7, has had security issues in its products before, including XSS and CSRF flaws in earlier releases. For CVE-2025-7645, the vendor shipped a patch within 48 hours of public disclosure, a better response than in some previous incidents. The repeat issues still suggest the vendor needs more rigorous code review and security testing in its development process.
References
- CVE-2025-7645 Official Entry (MITRE)
- VulDB Advisory
- Wordfence Patch Advisory
- WordPress Plugin Page
- Wordfence Vulnerability Database
- Stefan Ristic Blog Analysis
Source: This report was created using AI
If you have suggestions for improvement or feedback, please email us at [email protected]
