CVE-2026-114432
Received Received - Intake

Unauthenticated File Upload in Contact Form 7 WordPress Plugin

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: WPScan

Description
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is limited to an arbitrary file written into the uploads directory, which may still be served as active content such as HTML or SVG from the site's own origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-114432
EUVD
EUVD-2026-119468

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Contact Form 7 From 6.2 (inc) to 6.2.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Contact Form 7 WordPress plugin versions 6.2 to 6.2.3. It allows unauthenticated users to upload arbitrary files due to improper validation of file types and extensions. A flaw in temporary file cleanup leaves uploaded files on the server. On default Debian or Ubuntu Apache setups, attackers can execute these files remotely, leading to Remote Code Execution.

Detection Guidance

Check if your Contact Form 7 plugin version is between 6.2 and 6.2.3. Inspect the uploads directory for unexpected files, especially .phar, .html, or .svg files. Review server logs for unusual file upload activity or PHP execution attempts.

Impact Analysis

Attackers can upload malicious files to your server, which may lead to remote code execution if the server configuration allows it. Even on other configurations, arbitrary files may be written to the uploads directory and served as active content like HTML or SVG, potentially compromising your site.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA compliance requirements for data protection and security. It may result in unauthorized data exposure or modification, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Update Contact Form 7 to version 6.2.4 or later immediately. Disable directory listing in Apache if enabled. Ensure .htaccess rules block execution of uploaded files like .phar, .html, and .svg. Regularly audit the uploads directory for suspicious files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...