{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/contact-form-7--6.2.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:contact_form_7:contact_form_7:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-114432"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Contact Form 7 (\u003c 6.2.4)"],"_cs_severities":["critical"],"_cs_tags":["web-application","rce","file-upload","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Contact Form 7 WordPress plugin version 6.2.4 addresses a critical vulnerability (CVE-2026-114432) stemming from insufficient validation of file types and extensions during the upload process. The plugin also fails to properly remove temporary files, allowing them to persist on the server. On default Debian or Ubuntu Apache configurations where directory listing is enabled and .phar files are processed as PHP, an attacker can upload and execute malicious scripts. In other configurations, the flaw enables the storage of arbitrary content, such as HTML or SVG, in the web uploads directory, potentially facilitating cross-site scripting or other web-based attacks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to upload arbitrary files to a vulnerable server. Depending on server configuration, this can lead to Remote Code Execution (RCE) or the hosting of malicious active content served from the site's own origin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Contact Form 7 plugin to version 6.2.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit the web server configuration to disable directory listing for public upload directories.\u003c/li\u003e\n\u003cli\u003eReview server-side MIME type handling and PHP interpreter mappings to ensure only intended extensions are executed.\u003c/li\u003e\n\u003cli\u003eUse the hunt lead below to identify potential attempts to upload or access suspicious file types in web-accessible directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T03:24:15Z","date_published":"2026-11-09T03:24:15Z","id":"https://feed.craftedsignal.io/briefs/2026-11-contact-form-7-rce/","summary":"The Contact Form 7 WordPress plugin before version 6.2.4 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to write files to the server and potentially execute code via improperly configured PHP handlers.","title":"Contact Form 7: Arbitrary file upload remote code execution (CVE-2026-114432)","url":"https://feed.craftedsignal.io/briefs/2026-11-contact-form-7-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Contact Form 7 (\u003c 6.2.4)","version":"https://jsonfeed.org/version/1.1"}