Contact Form 7
Security incidents tagged Contact Form 7. Newest first.
1 Contact Form 7 incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 10
- Longest quiet run: 6 days (Oct 30–Nov 4)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Contact Form 7 6.2–6.2.3 lets anyone upload arbitrary files, leading to RCE on stock Debian/Ubuntu Apache (CVE-2026-114432)
Contact Form 7, a WordPress form plugin with more than 10 million active installs, did not validate the type or extension of files uploaded through a form file field in versions 6.2 through 6.2.3, and a flaw in its temporary-file cleanup left the uploaded file on disk. Unauthenticated visitors can therefore upload arbitrary files to any site using a form with a file field. Per WPScan, on a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to remote code execution; on other setups (nginx, or Apache with .htaccess overrides) it is limited to an arbitrary file in the uploads directory that may still be served as active content such as HTML or SVG from the site's own origin. The plugin's author fixed it in 6.2.4 on Oct 29 (with 6.2.4.1 the same day), switching file names to an extension safelist. WPScan published CVE-2026-114432 on Nov 8 and will release its proof of concept on Nov 19. Only the 6.2–6.2.3 releases are affected. No exploitation has been reported.
Contact Form 7 (WordPress plugin)Since Oct 29, 2026
