{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432) · updates",
  "home_page_url": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432",
  "feed_url": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432/feed.json",
  "description": "Contact Form 7, a WordPress form plugin with more than 10 million active installs, did not validate the type or extension of files uploaded through a form file field in versions 6.2 through 6.2.3, and a flaw in its temporary-file cleanup left the uploaded file on disk. Unauthenticated visitors can therefore upload arbitrary files to any site using a form with a file field. Per WPScan, on a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to remote code execution; on other setups (nginx, or Apache with .htaccess overrides) it is limited to an arbitrary file in the uploads directory that may still be served as active content such as HTML or SVG from the site's own origin. The plugin's author fixed it in 6.2.4 on Oct 29 (with 6.2.4.1 the same day), switching file names to an extension safelist. WPScan published CVE-2026-114432 on Nov 8 and will release its proof of concept on Nov 19. Only the 6.2–6.2.3 releases are affected. No exploitation has been reported.",
  "language": "en",
  "_pwn": {
    "slug": "contact-form-7-unauthenticated-file-upload-cve-2026-114432",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432/feed.xml",
    "llms": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432/llms.txt",
    "json": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432#2026-11-08-99c1d97d",
      "url": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432#2026-11-08-99c1d97d",
      "title": "Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432): CVE-2026-114432 is published by WPScan.",
      "content_text": "Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432): CVE-2026-114432 is published by WPScan.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-114432",
      "date_published": "2026-11-08T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114432",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432#2026-11-05-52450ebc",
      "url": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432#2026-11-05-52450ebc",
      "title": "Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432): WPScan publishes its advisory: missing file type validation plus a temporary-file cleanup flaw lets unauthenticated users upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache; PoC withheld until Nov 19.",
      "content_text": "Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432): WPScan publishes its advisory: missing file type validation plus a temporary-file cleanup flaw lets unauthenticated users upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache; PoC withheld until Nov 19.\n\nSource: https://wpscan.com/vulnerability/6b0a5d1f-84fb-425f-8d37-ddde5703937c/",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://wpscan.com/vulnerability/6b0a5d1f-84fb-425f-8d37-ddde5703937c/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432#2026-10-29-91ab6507",
      "url": "https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432#2026-10-29-91ab6507",
      "title": "Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432): Contact Form 7 6.2.4 ships with security fixes for an unauthenticated arbitrary file upload affecting 6.2 to 6.2.3, reported by Shinya Murakami and Jakub Herman via WPScan; 6.2.4.1 follows the same day.",
      "content_text": "Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432): Contact Form 7 6.2.4 ships with security fixes for an unauthenticated arbitrary file upload affecting 6.2 to 6.2.3, reported by Shinya Murakami and Jakub Herman via WPScan; 6.2.4.1 follows the same day.\n\nSource: https://contactform7.com/2026/10/29/contact-form-7-624/",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://contactform7.com/2026/10/29/contact-form-7-624/",
      "tags": [
        "critical"
      ]
    }
  ]
}