Contact Form 7 versions 6.2 through 6.2.3 contain an unauthenticated arbitrary file-upload flaw tracked as CVE-2026-114432. The vendor’s 6.2.4 release notes, dated 29 October 2026, say attackers can leverage multiple flaws “in combination, to upload files that should normally be blocked by validation logic and keep files that should normally be removed immediately after submission.” NVD published the CVE entry on 8 November 2026.
Takayuki Miyoshi’s release post recommends “upgrading to 6.2.4 for all users,” including sites not on the vulnerable 6.2–6.2.3 range, because the security enhancements apply more broadly. The issue was reported by Shinya Murakami and Jakub Herman via WPScan. Forms that include a file-upload field and sit on a host that publicly lists directory contents are the configurations the vendor flags as theoretical targets. The plugin requires WordPress 7.1 or higher and was tested up to WordPress 7.1.4 at release time.
What NVD and Patchstack say about impact
NVD’s description states the plugin “does not validate the type or extension of files uploaded through a form file field,” and that a temporary-file cleanup flaw can leave the file on disk. On “a stock Debian or Ubuntu Apache configuration” with directory listing enabled and .phar mapped to PHP, that can lead to remote code execution; elsewhere the practical impact is arbitrary file upload. NVD lists CVSS 9.8 (CNA); Patchstack scores it 8.1.
TSN is not stating that the flaw is actively exploited as a fact. Some CVE trackers say VulnCheck listed it in its own KEV on 8 November; that is not the same as a CISA KEV listing, and it has not been verified first-hand for this write-up. CISA’s catalogue is the bar TSN uses for “known exploited” federal listings. Until that bar is met, the defence case rests on the vendor patch and the server configuration, not on a federal due date.
Practical fixes
Upgrade to Contact Form 7 6.2.4 or later. The vendor switched wpcf7_antiscript_file_name() from an unsafelist to a safelist of extensions, and tightened wpcf7_unship_uploaded_file() arguments. Operators who customise uploads should review the wpcf7_file_extension_safelist filter if they rely on extensions outside the default safelist—for example sites that accept .zip uploads will need an explicit filter merge rather than assuming the old unsafelist behaviour still applies.
Separately, disable public directory listing on the web server, and treat any host that maps uploaded .phar (or similar) into the PHP interpreter as high risk until the plugin and server configuration are both hardened. Shared-hosting customers who cannot change Apache mappings should still ship 6.2.4 and ask their host whether directory indexes are on. TSN’s earlier WordPress 7.1.4 RCE patch coverage remains the nearest same-stack read for operators patching core and plugins together. Where possible, confirm the live plugin version string after update rather than trusting a cached dashboard notice.
Plugin defaults inherit the web server’s worst assumptions
Contact Form 7 is ubiquitous precisely because it is easy to drop a file field onto a public form. The vulnerability class here is not a novel WordPress trick; it is the combination of weak type checks, leftover temp files, and a stock Apache layout that happily lists directories and executes what it finds. That is why the vendor’s fix hardens the plugin while the operational advice still includes turning directory listing off.
Calling every tracker KEV entry “actively exploited” without a CISA listing or a primary incident report blurs the evidence bar operators need. The durable actions are version 6.2.4, a safelist-aware upload policy, and a web-server configuration that does not turn an uploaded file into an interpreter entry point. Until CISA or a primary victim report lands, keep exploitation language attributed to tracker claims—or omit it. Site owners who only bump the plugin version without checking directory listing and script mappings still leave the server-side half of the attack path open.
Sources
- Contact Form 7 6.2.4 release notes
- NVD: CVE-2026-114432
- Patchstack: Contact Form 7 unauthenticated arbitrary file upload
Related stories
WordPress 7.1.4’s update-path RCE fix is the nearest TSN read for operators already in a WordPress patching window.
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
