Contact Form 7: arbitrary file upload (CVE-2026-114432)
A vulnerability, CVE-2026-114432 (CVSS 9.8), was published for the Contact Form 7 WordPress plugin. It does not validate the type or extension of files uploaded through a file field, and a temporary-file cleanup flaw leaves the uploaded file on disk.
Checked in Shield: no
Who is affected
WordPress sites running Contact Form 7 before 6.2.4. On a stock Debian or Ubuntu Apache setup (directory listing, .phar mapped to PHP) this can lead to remote code execution. On nginx or Apache with .htaccess overrides, a file is written to uploads and may be served as HTML or SVG.
How to check
In the WordPress admin, open Plugins and check the Contact Form 7 version. Below 6.2.4 means the site is affected. Also look in the uploads directory for unfamiliar files such as .phar, .php, .html or .svg.
How to fix
Update Contact Form 7 to 6.2.4, which contains the fix. Review and remove any unfamiliar files found in uploads.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: NVD, CVE-2026-114432.
