Contact Form 7, running on 10 million sites, patches a file-upload bug
CVE-2026-114432 lets an unauthenticated visitor upload a file with any extension through a CF7 form field. Fixed in 6.2.4, with remote code execution possible on some Apache setups.
Contact Form 7, the WordPress form plugin installed on more than 10 million sites, has patched an unauthenticated file-upload vulnerability tracked as CVE-2026-114432, disclosed today. Versions 6.2 through 6.2.3 don’t validate the type or extension of files submitted through a form’s file field, and a separate flaw in how the plugin cleans up temporary files leaves the upload sitting on disk afterwards.
No authentication is required. On a stock Debian or Ubuntu server running Apache with directory listing enabled and .phar mapped to the PHP handler, that’s enough for remote code execution. On other setups, an attacker can still write an arbitrary file, such as HTML or SVG, into the uploads directory and have it served as active content. The fix is in 6.2.4.
Why it matters: Contact Form 7 is one of the most common ways WordPress sites take input from strangers, which is exactly the surface this bug sits on. If you run it, update to 6.2.4 or later regardless of your server configuration, since even the milder outcome still means a stranger writing files to your server.
The caveat: Contact Form 7’s own changelog doesn’t call out a security fix by name, just a version bump; the technical detail here comes from Strix’s CVE writeup, and NVD hasn’t assigned a CVSS score yet.