File Upload Vulnerability in Contact Form 7 Plugin by WordPress
CVE-2026-114432
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 8 November 2026
Badges
What is CVE-2026-114432?
The Contact Form 7 plugin for WordPress versions prior to 6.2.4 has a critical flaw in its handling of file uploads. It fails to properly validate the type or extension of files uploaded through form fields. Furthermore, inadequate temporary file clean-up protocol leaves uploaded files on the server, permitting unauthorized users to upload arbitrary files. In default Debian or Ubuntu Apache setups, where directory listings are enabled, these files may be executed, leading to Remote Code Execution vulnerabilities. When using other configurations, like nginx, the risk is limited, but it still allows for potentially dangerous content to be served from the uploads directory, posing significant security implications for affected websites.
Affected Version(s)
Contact Form 7 6.2 < 6.2.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.