CVE-2026-114432: Arbitrary File Upload in Contact Form 7
A critical vulnerability has been published affecting the Contact Form 7 WordPress plugin. Tracked as CVE-2026-114432 with a CVSS score of 9.8, it affects versions before 6.2.4.
Per the NVD description, the plugin does not validate the type or extension of files uploaded through a form file field. A flaw in its temporary-file cleanup then leaves the uploaded file on disk. Unauthenticated users can therefore place arbitrary files on the site. The NVD entry also refers to the behaviour on a stock Debian-based setup; review the full entry for the exact conditions under which uploaded files become executable.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-114432 |
| CVSS Score | 9.8 (Critical) |
| Affected Plugin | Contact Form 7 (WordPress) |
| Affected Versions | Before 6.2.4 |
| Fixed Version | 6.2.4 |
| Authentication Required | None |
| Impact | Arbitrary file upload |
| Published | 2026-11-08 |
Why This Matters
Contact Form 7 is one of the most widely installed WordPress plugins. Any site that exposes a form with a file upload field is a candidate. Arbitrary file upload bugs are commonly used to drop web shells, which turn a form submission into remote code execution.
Remediation
- Update Contact Form 7 to 6.2.4 or later on every site you manage.
- Inspect upload directories (including the plugin's temporary upload folder under
wp-content/uploads/) for unexpected.php,.phtml, or other executable files. - Block script execution in upload directories at the web server level.
- Review forms with file fields and remove any that are not needed.
- Check access logs for unusual POST requests to form endpoints since the disclosure.