Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432)

Contact Form 7, a WordPress form plugin with more than 10 million active installs, did not validate the type or extension of files uploaded through a form file field in versions 6.2 through 6.2.3, and a flaw in its temporary-file cleanup left the uploaded file on disk. Unauthenticated visitors can therefore upload arbitrary files to any site using a form with a file field. Per WPScan, on a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to remote code execution; on other setups (nginx, or Apache with .htaccess overrides) it is limited to an arbitrary file in the uploads directory that may still be served as active content such as HTML or SVG from the site's own origin. The plugin's author fixed it in 6.2.4 on Oct 29 (with 6.2.4.1 the same day), switching file names to an extension safelist. WPScan published CVE-2026-114432 on Nov 8 and will release its proof of concept on Nov 19. Only the 6.2–6.2.3 releases are affected. No exploitation has been reported.

Why this severity: Unauthenticated arbitrary file upload in a 10M-install plugin; remote code execution on stock Debian/Ubuntu Apache configs with directory listing, otherwise an arbitrary file written to the uploads directory; only versions 6.2–6.2.3 affected; no exploitation reported

Started

Oct 29, 2026

CVE

CVE-2026-114432

• WordPress
• #Contact Form 7
• #Wordpress Plugin
• #File Upload
• #Unauthenticated
• RCE