Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename
- Exploited
- No known exploitation
- Fix
- Fixed in 6.2.4
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 6.2.4.
- Last modified
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.21% · 12th percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 30/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
The Contact Form 7 WordPress plugin lets unauthenticated users upload arbitrary files to a site through a form file field, because it does not check file type or extension and a cleanup flaw leaves the file on disk. On a stock Debian or Ubuntu Apache setup the uploaded file can be executed, leading to remote code execution, while on other configurations it can still be served as active content such as HTML or SVG from the site's own origin.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is limited to an arbitrary file written into the uploads directory, which may still be served as active content such as HTML or SVG from the site's own origin.
cve.now Index
- Exploitation0/40No signal
- Exposure20/25No login or user action needed per the CVSS vector, CISA rates it automatable · Unknown: No advisory context yet
- Reach?/20Unknown. No tracked technology or package matched
- Severity10/10CVSS 9.8, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 75 if added to CISA KEV
- Would score about 70 if CISA's SSVC rates exploitation active
- Would score about 35 if advisories confirm default setups are exposed
What to do
Upgrade to a fixed version: 6.2.4.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
- Posted on X by cve.now
Affected versions
- Unknown Contact Form 7
From 6.2 · fixed in 6.2.4
Evidence 1
- Exploit
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-114432
Is CVE-2026-114432 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-114432?
Contact Form 7: from 6.2 before 6.2.4.Source: cve.now feed data
How do I fix CVE-2026-114432?
Upgrade to a fixed version: 6.2.4.Source: cve.now feed data