Contact Form 7 File Upload Flaw (CVE-2026-114432): Which WordPress Sites Are Exposed and What to Do

Contact Form 7 versions 6.2 to 6.2.3 have an unauthenticated file upload flaw, CVE-2026-114432, rated CVSS 9.8. On some Apache setups the uploaded file can be run as code; on others it can still be served as HTML or SVG from your own domain. The fix is in 6.2.4, and the current release is 6.2.5. WPScan has said it will publish its proof of concept on 19 November 2026. If your WordPress site has a form with a file upload field, this one is worth checking now.

This article is for people who run a WordPress site, or look after one for a client. It does not show how the upload is done, and nothing here should be pointed at a site you do not run.

We build HackerMe, a free automated website security scanner. This piece was first published on the HackerMe Security blog: https://security.hackerme.ai/contact-form-7-file-upload-flaw-cve-2026-114432/

What the public record says

Version 6.2 of Contact Form 7 came out on 6 October 2026. The developer’s release note for version 6.2.4, dated 29 October 2026, says the vulnerability is seen only in versions 6.2 to 6.2.3, and describes it as an unauthenticated arbitrary file upload. In the developer’s words, attackers can combine several flaws to upload files that validation should block, and to keep files that should be removed right after the form is submitted.

Wordfence published its entry on 31 October 2026 with a CVSS score of 9.8, critical. WPScan, which coordinated the report, published its entry on 5 November 2026 and credits researcher Shinya Murakami. The developer also credits Jakub Herman.

The CVE record, CVE-2026-114432, went into the National Vulnerability Database on 8 November 2026. CISA’s enrichment there gives it a CVSS 3.1 score of 9.8, and marks it as automatable, with total technical impact. In that same record, CISA’s assessment from 8 November 2026 says exploitation none, and as of 11 November 2026 the CVE is not in CISA’s Known Exploited Vulnerabilities catalog. The clock here is the proof of concept date, 19 November 2026, not a confirmed attack wave. That is the window to update.

Which sites are exposed, and which are not

The site is in the exposed set when both of the following are true:

• It runs Contact Form 7 version 6.2, 6.2.1, 6.2.2, or 6.2.3.
• At least one form has a file upload field. The developer says, in theory, every form with a file uploading field can be a target.

Sites on 6.2.4 or 6.2.5 are patched for this issue. Sites that run Contact Form 7 but have no file upload field are outside the condition the developer describes. A patched plugin is not a promise that an older uploaded file has already been removed, so the leftover-file check below still matters if the site was on 6.2 to 6.2.3 for any period after 6 October 2026.

What to do on a site you own

Update Contact Form 7 to 6.2.5 (or at least 6.2.4). Then confirm the installed version in the plugin list, and confirm that a test submission of a legitimate file still works. If you cannot update immediately, temporarily disable or remove the file upload field on public forms until you can.

After the update, look for files in the uploads folder that nobody on the team placed there, especially recent PHP, HTML, SVG, or unexpected executable types. Turn off directory listing on that folder if it is on, and block PHP from running in uploads if your host lets you. Those two server rules are useful beyond this CVE.

If you find a file you cannot explain, treat it as a possible compromise and investigate the rest of the site. A starting point is this guide: https://security.hackerme.ai/how-to-tell-if-your-website-has-been-hacked/

Rehearse the plugin update on staging when you can, and then check that the update actually landed: https://security.hackerme.ai/how-to-check-whether-a-wordpress-security-update-worked/

What an outside check can and cannot see

An outside check of a domain you own can often see the plugin version if it is disclosed, and it can see some public leftover files if they are reachable from the web. It cannot see files that are not web-accessible, and it cannot prove that a site was never used for an upload. A clean report is one input. It is not a claim that the site is free of problems.

Sources

• NVD, CVE-2026-114432: https://nvd.nist.gov/vuln/detail/CVE-2026-114432
• WPScan entry, 5 November 2026: https://wpscan.com/vulnerability/6b0a5d1f-84fb-425f-8d37-ddde5703937c/
• Contact Form 7 6.2.4 release note, 29 October 2026: https://contactform7.com/2026/10/29/contact-form-7-624/
• Contact Form 7 6.2.5 release note, 10 November 2026: https://contactform7.com/2026/11/10/contact-form-7-625/
• Wordfence entry, 31 October 2026: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-7/contact-form-7-62-623-unauthenticated-arbitrary-file-upload

The full version, including the video walk-through and the leftover-file checks in more detail, is on the blog: https://security.hackerme.ai/contact-form-7-file-upload-flaw-cve-2026-114432/