Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)

Information

Software Type Plugin
Software Slug extensions-for-cf7 (view on wordpress.org)
Software Status Active
Software Author htplugins
Software Downloads 175,528
Software Active Installs 5,000
Software Record Last Updated August 11, 2026

5 Vulnerabilities

Submit a Vulnerability
Extensions For CF7 <= 3.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVE-2026-24991
Jan 23, 2026
Researcher: Nabil Irawan
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion
8.1
CVE-2025-7645
Jul 21, 2025
Researcher: Phat RiO
Extensions For CF7 <= 3.2.0 - Authenticated (Admin+) Sever-Side Request Forgery
3.8
CVE-2025-24695
Jan 24, 2025
Researcher: Marek Mikita
Extensions For CF7 <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-29102
Mar 15, 2024
Researcher: R3N0
Extensions For CF7 <= 2.0.8 - Cross-Site Request Forgery
4.3
CVE-2023-23899
Jan 20, 2023
Researcher: István Márton
Title Status CVE ID CVSS Researchers Date
Extensions For CF7 <= 3.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference Patched CVE-2026-24991 4.3 Nabil Irawan January 23, 2026
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion Patched CVE-2025-7645 8.1 Phat RiO July 21, 2025
Extensions For CF7 <= 3.2.0 - Authenticated (Admin+) Sever-Side Request Forgery Patched CVE-2025-24695 3.8 Marek Mikita January 24, 2025
Extensions For CF7 <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2024-29102 7.2 R3N0 March 15, 2024
Extensions For CF7 <= 2.0.8 - Cross-Site Request Forgery Patched CVE-2023-23899 4.3 István Márton January 20, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation