Skip to content
Threat Feed
Subscribe

Product

Contact Form 7 (< 6.2.4)

1 brief RSS
critical advisory

Contact Form 7: Arbitrary file upload remote code execution (CVE-2026-114432)

The Contact Form 7 WordPress plugin before version 6.2.4 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to write files to the server and potentially execute code via improperly configured PHP handlers.

Contact Form 7 web-application rce file-upload vulnerability
2t 1c