# Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432) · pwn.watch > Contact Form 7, a WordPress form plugin with more than 10 million active installs, did not validate the type or extension of files uploaded through a form file field in versions 6.2 through 6.2.3, and a flaw in its temporary-file cleanup left the uploaded file on disk. Unauthenticated visitors can therefore upload arbitrary files to any site using a form with a file field. Per WPScan, on a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to remote code execution; on other setups (nginx, or Apache with .htaccess overrides) it is limited to an arbitrary file in the uploads directory that may still be served as active content such as HTML or SVG from the site's own origin. The plugin's author fixed it in 6.2.4 on Oct 29 (with 6.2.4.1 the same day), switching file names to an extension safelist. WPScan published CVE-2026-114432 on Nov 8 and will release its proof of concept on Nov 19. Only the 6.2–6.2.3 releases are affected. No exploitation has been reported. Page: https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432 · generated 2026-11-08T06:45:48.368Z ## Status - Severity: critical · status: live · patch: patched - Product: Contact Form 7 (WordPress plugin) - Started: 2026-10-29 - CVEs: CVE-2026-114432 - Affected: Contact Form 7 6.2 through 6.2.3 (forms with a file upload field) - Fixed in: Contact Form 7 6.2.4 (6.2.4.1 recommended) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432/feed.xml - JSON Feed: https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432.json - This file: https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432/llms.txt ## Updates (newest first) - 2026-11-08: CVE-2026-114432 is published by WPScan. (https://nvd.nist.gov/vuln/detail/CVE-2026-114432) - 2026-11-05: WPScan publishes its advisory: missing file type validation plus a temporary-file cleanup flaw lets unauthenticated users upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache; PoC withheld until Nov 19. (https://wpscan.com/vulnerability/6b0a5d1f-84fb-425f-8d37-ddde5703937c/) - 2026-10-29: Contact Form 7 6.2.4 ships with security fixes for an unauthenticated arbitrary file upload affecting 6.2 to 6.2.3, reported by Shinya Murakami and Jakub Herman via WPScan; 6.2.4.1 follows the same day. (https://contactform7.com/2026/10/29/contact-form-7-624/) ## Fix brief # Security brief: Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432) Source: https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432 · status: live · severity: critical · updated Nov 8, 2026, 06:35 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Contact Form 7, a WordPress form plugin with more than 10 million active installs, did not validate the type or extension of files uploaded through a form file field in versions 6.2 through 6.2.3, and a flaw in its temporary-file cleanup left the uploaded file on disk. Unauthenticated visitors can therefore upload arbitrary files to any site using a form with a file field. Per WPScan, on a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to remote code execution; on other setups (nginx, or Apache with .htaccess overrides) it is limited to an arbitrary file in the uploads directory that may still be served as active content such as HTML or SVG from the site's own origin. The plugin's author fixed it in 6.2.4 on Oct 29 (with 6.2.4.1 the same day), switching file names to an extension safelist. WPScan published CVE-2026-114432 on Nov 8 and will release its proof of concept on Nov 19. Only the 6.2–6.2.3 releases are affected. No exploitation has been reported. Severity detail: Unauthenticated arbitrary file upload in a 10M-install plugin; remote code execution on stock Debian/Ubuntu Apache configs with directory listing, otherwise an arbitrary file written to the uploads directory; only versions 6.2–6.2.3 affected; no exploitation reported - Product: Contact Form 7 (WordPress plugin) - CVE / advisory ids: CVE-2026-114432 ## Affected versions - Contact Form 7 6.2 through 6.2.3 (forms with a file upload field) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Contact Form 7 6.2.4 (6.2.4.1 recommended) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes On WordPress sites, check the Contact Form 7 version (wp plugin get contact-form-7 --field=version). If it is 6.2 through 6.2.3, update to 6.2.4.1 or later (wp plugin update contact-form-7). Disable directory listing for wp-content/uploads, and look in wp-content/uploads/wpcf7_uploads/ for leftover files you did not expect. Forms that accept extensions outside the new safelist (for example docx, xlsx, zip) need the wpcf7_file_extension_safelist filter after updating. ## Latest updates - Nov 8, 2026: CVE-2026-114432 is published by WPScan. - Nov 5, 2026: WPScan publishes its advisory: missing file type validation plus a temporary-file cleanup flaw lets unauthenticated users upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache; PoC withheld until Nov 19. - Oct 29, 2026: Contact Form 7 6.2.4 ships with security fixes for an unauthenticated arbitrary file upload affecting 6.2 to 6.2.3, reported by Shinya Murakami and Jakub Herman via WPScan; 6.2.4.1 follows the same day. ## Advisories - [Contact Form 7 6.2.4](https://contactform7.com/2026/10/29/contact-form-7-624/) (Contact Form 7) - [Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename](https://wpscan.com/vulnerability/6b0a5d1f-84fb-425f-8d37-ddde5703937c/) (WPScan) - [CVE-2026-114432](https://nvd.nist.gov/vuln/detail/CVE-2026-114432) (NVD) --- Machine-readable: https://pwn.watch/i/contact-form-7-unauthenticated-file-upload-cve-2026-114432.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.