#Contact Form 7
All CosmicBytez Labs articles tagged #Contact Form 7, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-114432: Contact Form 7 Before 6.2.4 Allows Unauthenticated Arbitrary File Upload
Contact Form 7 before 6.2.4 does not validate uploaded file types and leaves files on disk after cleanup fails, allowing unauthenticated arbitrary uploads.
- Security
CVE-2026-94589: Extensions For CF7 Unauthenticated Arbitrary File Upload to RCE
An unauthenticated attacker can upload a disguised shell.php through Extensions For CF7's signature field, leading to remote code execution (CVSS 9.8).
- Security
CVE-2026-82901: Ultra Addons for Contact Form 7 Arbitrary File Upload
Ultra Addons for Contact Form 7 (≤ 3.5.50) allows unauthenticated arbitrary file upload via a weakly validated PDF Generator signature field, enabling RCE.
- Security
CVE-2026-14484: WordPress RapiSafe Plugin Arbitrary File Deletion
Critical unauthenticated arbitrary file deletion in WordPress RapiSafe plugin v1.0.4 and below allows attackers to delete any file on the server.
- Security
CVE-2026-1540: Spam Protect CF7 WordPress Plugin PHP Log RCE
The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows an editor-level attacker to achieve Remote Code Execution by logging a crafted...