Contact Form 7 CVE-2026-114432 is an unauthenticated arbitrary file-upload flaw in the WordPress plugin's form file field. According to the WPScan CNA record and the NVD description, versions before 6.2.4 do not validate the uploaded file's type or extension, and a temporary-file cleanup flaw can leave the file on disk. On a stock Debian or Ubuntu Apache configuration that lists directory contents and maps .phar to the PHP handler, that stored file can be located and executed, leading to remote code execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is still an arbitrary write into the uploads directory that may be served as active content such as HTML or SVG from the site's own origin.
The WPScan CNA record for CVE-2026-114432 publishes no CVSS metric. CISA's ADP enrichment on the same CVE scores it CVSS 3.1 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and records SSVC options Exploitation none, Automatable yes, and Technical Impact total (timestamp 2026-11-08T18:57:50.317808Z). That ADP score is a network-reachable, unauthenticated impact assessment — not a report that attacks are already under way. CVE-2026-114432 is not in CISA's Known Exploited Vulnerabilities catalog (catalogVersion 2026.11.06, checked November 9, 2026 at 16:16 Asia/Jerusalem UTC+2).
WPScan's vulnerability page states that its proof of concept will be displayed on November 19, 2026, "to give users the time to update." As of this review (9 November 2026), that is a WPScan-scheduled future display date — the PoC is not yet shown on the WPScan entry, and this advisory does not treat the future date as evidence that a public exploit is already available or that attacks are under way. Organizations that depend on WordPress marketing sites, portals, or intake and support forms should still update before that scheduled display window.
Technical Information
WPScan titles the issue an unauthenticated arbitrary file upload via an invalid UTF-8 filename affecting Contact Form 7 6.2 through 6.2.3. The CNA/NVD description is the technical authority used here: missing type and extension validation on file-field uploads, combined with a cleanup flaw that leaves the uploaded temporary file on disk, allows an unauthenticated visitor who can submit a form with a file field to place arbitrary content on the site.
The RCE outcome is conditional, not universal. The same primary description states that on stock Debian or Ubuntu Apache with directory listing enabled and .phar mapped to PHP, the stored file can be found and executed. Elsewhere, including nginx or Apache setups that restrict listing or execution, residual risk still includes arbitrary files in uploads that may be served as HTML or SVG from the site origin. Do not treat "not every host yields RCE" as "safe to delay."
CWE-434 (unrestricted upload of a file with a dangerous type) is the weakness recorded by CISA-ADP and the CNA. This advisory does not invent exploit steps, payloads, or indicators beyond what those primaries describe.
Affected Product Versions
| Product | Affected versions (CNA / WPScan) | Fixed |
|---|---|---|
| Contact Form 7 (WordPress plugin) | 6.2 through 6.2.3 (CNA: 6.2 before 6.2.4) | 6.2.4 or later |
The vendor announcement Contact Form 7 6.2.4 (published 29 October 2026 at contactform7.com) states that the vulnerability is seen only in Contact Form 7 6.2 to 6.2.3 and recommends upgrading to 6.2.4 for all users. WPScan lists the fix as 6.2.4. The WordPress.org plugin directory currently shows version 6.2.4.1 and links the same 29 October announcement from its developers changelog. Prefer the exact installed plugin version from each supplier over a generic "WordPress is patched" assurance.
WordPress.org reports 10+ million active installations for Contact Form 7. That figure is a directory metric for the plugin's popularity; it is not a count of confirmed vulnerable sites and is not used here as an exposure estimate.
Workaround and Mitigation
Update Contact Form 7 to 6.2.4 or later (WordPress.org currently lists 6.2.4.1) through the site's supported plugin update process, then verify the installed version on every WordPress property that exposes a CF7 file field. Test form submissions that accept attachments after the change.
Where immediate update is delayed, treat server-side hardening as risk reduction only — not as a substitute for the vendor fix. The primary description's RCE path depends on directory listing and .phar handling; disabling listing and preventing execution of uploaded content in wp-content/uploads can reduce that path's reliability, but those controls are environment-specific and are not presented here as a validated universal workaround. Review forms that accept file uploads and restrict who can reach them when business requirements allow.
After remediation, inventory the uploads directories associated with CF7 forms for unexpected files left from the cleanup flaw window, and investigate anomalies through normal incident response. Updating the plugin alone does not prove that no stray file was written beforehand.
Indicators of Compromise
No CVE-specific IP addresses, domains, file hashes, or reliable detection signatures were established in the primary materials reviewed for this draft. There is no basis to invent them.
Unexpected files under WordPress uploads paths used by contact forms, unexplained .phar or other executable-like objects in publicly listable directories, or new admin/plugin changes without a change ticket are investigative leads only — not definitive indicators of CVE-2026-114432.
What to Ask Your Suppliers Today
Ask any critical supplier that runs WordPress for you — marketing sites, customer portals, or intake and support forms:
- Do you use Contact Form 7? Identify every property where CF7 is installed or where a file-upload field is present on a CF7 form.
- Are you on Contact Form 7 6.2.4 or later? Request the exact installed plugin version (for example 6.2.4 or 6.2.4.1), not a vague "WordPress is up to date."
- If not, what is your patch date? Require an owner, target date, and completion evidence ahead of WPScan's scheduled PoC display date of 19 November 2026.
- Have you checked upload directories for stray files? Ask whether uploads paths used by CF7 forms were reviewed for unexpected files consistent with the cleanup flaw, and whether anything found was escalated.
Track incomplete answers to closure. The supplier questions are qualitative TPRM follow-ups; they are not an internet-scale prevalence claim.
Need help working through WordPress and form-plugin suppliers exposed to Contact Form 7 CVE-2026-114432 before WPScan's scheduled PoC display date? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- Contact Form 7 6.2.4 release announcement — vendor; published 29 October 2026; affected 6.2 to 6.2.3; upgrade to 6.2.4.
- WordPress.org: Contact Form 7 — Active installations 10+ million (directory metric); current version 6.2.4.1; changelog links the 6.2.4 announcement.
- WPScan: Contact Form 7 unauthenticated arbitrary file upload (CVE-2026-114432) — CNA entry; Fixed in 6.2.4; states PoC will be displayed on 19 November 2026.
- CVE record CVE-2026-114432 — WPScan CNA affected 6.2 before 6.2.4 (no CNA CVSS); CISA-ADP CVSS 3.1 9.8 and SSVC (Exploitation none / Automatable yes / Technical Impact total, 2026-11-08T18:57:50.317808Z).
- NVD CVE-2026-114432 — Received; mirrors CISA-ADP 9.8 and SSVC.
- CISA vulnerability catalog JSON feed — catalogVersion 2026.11.06, checked November 9, 2026 at 16:16 Asia/Jerusalem UTC+2.
