Critical CVSS 9.8 file upload flaw in Contact Form 7 fixed in version 6.2.4

Critical flaw fixed in October

Contact Form 7 versions 6.2 to 6.2.3 contain an unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-114432. Wordfence has scored the flaw 9.8 on the CVSS scale, putting it in the critical band, and CISA's enrichment in the US National Vulnerability Database marks it as automatable with total technical impact. The plugin's developer fixed the issue in version 6.2.4, released on 29 October 2026, and the current release is 6.2.5.

What the flaw allows

According to the developer's release note, attackers can chain several weaknesses in the plugin's upload handling to submit files that validation should have rejected and to retain files on the server that Contact Form 7 would normally delete right after a form submission. A write-up by security firm HackerMe, republished on dev.to, explains that the consequences depend on server configuration: on some Apache setups an uploaded file can be executed as code, while on other setups it can still be served as HTML or SVG from the site's own domain.

Which sites are exposed

HackerMe's analysis sets out two conditions that must both hold: the site runs Contact Form 7 version 6.2, 6.2.1, 6.2.2 or 6.2.3, and at least one of its forms has a file upload field. The developer has said that, in theory, any form with a file uploading field can be a target. Sites on 6.2.4 or 6.2.5 are patched, and sites that use the plugin without any file upload fields fall outside the condition the developer describes.

Because version 6.2 shipped on 6 October 2026, any site that ran an affected version at any point since then should also check for files left behind during that window. Installing the patch does not delete anything an attacker may already have uploaded.

Disclosure timeline and the deadline

The public record, as assembled by HackerMe, runs as follows. The developer's 6.2.4 release note appeared on 29 October 2026. Wordfence published its entry on 31 October with the CVSS 9.8 rating. WPScan, which coordinated the report, published its entry on 5 November and credited researcher Shinya Murakami; the developer also credits Jakub Herman. The CVE entered the National Vulnerability Database on 8 November.

CISA's assessment of 8 November recorded no exploitation, and as of 11 November the CVE was not in the agency's Known Exploited Vulnerabilities catalog. The practical deadline is instead WPScan's stated plan to publish a proof of concept on 19 November 2026. That date, rather than a confirmed attack wave, defines the window in which to update.

What site owners should do

HackerMe recommends updating to 6.2.5, or at least 6.2.4, then verifying the installed version in the plugin list and testing that a legitimate file submission still works. Where an immediate update is not possible, the interim measure is to disable or remove the file upload field from public forms.

After updating, inspect the uploads folder for anything unexplained, particularly recent PHP, HTML or SVG files or other unexpected executable types. Two server rules are worth applying regardless of this CVE: disable directory listing on the uploads folder, and block PHP execution in it where the host permits. Any file that cannot be accounted for should be treated as a possible compromise, with the rest of the site investigated.

The write-up also cautions on the limits of external scanning: an outside check can see a disclosed plugin version and publicly reachable leftover files, but it cannot see files that are not web-accessible and cannot prove a site was never used for an upload.

Why it matters

Contact Form 7 is widely used across WordPress sites, and file upload fields are a common feature, so the affected combination of an unpatched version plus an upload form is far from rare. The flaw requires no authentication, sits at the top of the CVSS scale and is flagged as automatable by CISA. No attacks have been confirmed so far, but exploit code is scheduled to go public on 19 November, which makes the days before then the window that matters. Finally, the response does not end with the update: files uploaded during the exposure window may still be sitting on the server, and checking for them is part of the fix.