Contact Form 7: Arbitrary file upload remote code execution (CVE-2026-114432)

The Contact Form 7 WordPress plugin version 6.2.4 addresses a critical vulnerability (CVE-2026-114432) stemming from insufficient validation of file types and extensions during the upload process. The plugin also fails to properly remove temporary files, allowing them to persist on the server. On default Debian or Ubuntu Apache configurations where directory listing is enabled and .phar files are processed as PHP, an attacker can upload and execute malicious scripts. In other configurations, the flaw enables the storage of arbitrary content, such as HTML or SVG, in the web uploads directory, potentially facilitating cross-site scripting or other web-based attacks.

Impact

Successful exploitation allows unauthenticated remote attackers to upload arbitrary files to a vulnerable server. Depending on server configuration, this can lead to Remote Code Execution (RCE) or the hosting of malicious active content served from the site's own origin.

Recommendation

• Update the Contact Form 7 plugin to version 6.2.4 or later immediately.
• Audit the web server configuration to disable directory listing for public upload directories.
• Review server-side MIME type handling and PHP interpreter mappings to ensure only intended extensions are executed.
• Use the hunt lead below to identify potential attempts to upload or access suspicious file types in web-accessible directories.