A critical flaw in Contact Form 7, one of the most widely used WordPress plugins, lets unauthenticated visitors upload arbitrary files to affected sites. The vulnerability, tracked as CVE-2026-114432, was published on 8 November 2026 and carries the maximum practical severity rating of 9.8 out of 10.

Contact Form 7 is listed on WordPress.org with more than 10 million active installations, so the flaw potentially affects a very large number of websites. It affects versions 6.2, 6.2.1, 6.2.2 and 6.2.3 of the plugin. The fix arrived in version 6.2.4, released on 29 October 2026, and the plugin's developer, Rock Lobster, recommends that every user upgrade, even those on older versions.

How the flaw works

The problem sits in the way Contact Form 7 handles files uploaded through a form's file field. According to the CVE record, the plugin does not validate the type or extension of uploaded files, and a second flaw in its temporary-file cleanup leaves the uploaded file on disk instead of removing it immediately after submission.

On a stock Debian or Ubuntu Apache server, where directory contents are listed publicly and .phar files are mapped to the PHP handler, an attacker can locate the stored file and execute it, leading to remote code execution and full control of the site. On other setups, including nginx and Apache with .htaccess overrides enabled, the impact is narrower but still serious: the uploaded file sits in the uploads directory and may be served as active content, such as HTML or SVG, from the site's own origin.

The flaw was found by researchers Shinya Murakami and Jakub Herman, who reported it through WPScan. It is classed as CWE-434, unrestricted upload of file with dangerous type, and needs no login, no user interaction and no special conditions beyond a form with a file upload field.

What site owners should do

The fix is straightforward: update Contact Form 7 to version 6.2.4 or later. The update replaces the old blocklist approach to file names with a safelist of permitted extensions, covering audio, video and image formats plus PDF and plain text files. Anything outside that list has its extension converted to a safe alternative automatically, and site owners can extend the list with a filter hook if they need formats such as zip files.

Site owners should also check their uploads directory for unfamiliar files, such as .phar, .php, .html or .svg files they do not recognise, and remove anything suspicious. As of 8 November, the flaw is not listed in CISA's Known Exploited Vulnerabilities catalogue and no exploitation in the wild has been reported, but the CVE record notes the flaw is automatable, and the sheer number of affected sites makes it a likely target for mass scanning.

Because the vulnerable versions were only the current release line for 24 days, many sites will already have moved on, but any site still running Contact Form 7 6.2 to 6.2.3 with a file upload form should treat the update as urgent.