Security notice
Use Contact Form 7 on WordPress? Versions 6.2 to 6.2.3 let anyone upload files to your site. Update to 6.2.4 or later today.
Updated November 11, 2026: WordPress.org now lists Contact Form 7 6.2.5, which also fixes two separate, lower-risk issues. We removed the line saying no attacks had been reported. This flaw is still not on the CISA list of known exploited flaws. Previous update: Monday, November 9, 2026, 10:02 AM ET.
Contact Form 7 versions 6.2 to 6.2.3 have CVE-2026-114432. Someone without a login can upload any file through a form that has a file upload field, and the file stays on your server. On some common server setups that file can then be run as code, which hands over the whole site. Update to 6.2.4 or later today; WordPress.org now lists 6.2.5. WPScan plans to publish the attack details on November 19, 2026, so update before then. (WPScan, NVD, WordPress.org)
What happened
- The flaw. Contact Form 7 does not check the type or extension of files sent through a form's file upload field, and a flaw in how it cleans up temporary files leaves the uploaded file on the server. No login is needed. (WPScan, NVD)
- What an attacker gets. On a standard Debian or Ubuntu server running Apache, which lists folder contents and runs .phar files as PHP, the attacker can find the file and run it as code. That means full control of the site. On other setups, including nginx and Apache with .htaccess overrides, the attacker can still place a file in your uploads folder, such as an HTML or SVG page that is served from your own domain. (WPScan)
- Which versions. WPScan lists 6.2 to 6.2.3 as affected and 6.2.4 as fixed. Contact Form 7 released 6.2.4 on October 29, 2026, and recommends it for every site. WordPress.org now ships 6.2.5, released November 10, 2026, which also fixes two separate, lower-risk issues. (WPScan, Contact Form 7, Contact Form 7 6.2.5, WordPress.org)
- Severity. The CVE record rates it CVSS 9.8 (critical). It is not on the CISA list of known exploited flaws (checked November 11, 2026). WPScan will publish its proof of concept on November 19, 2026. (NVD, WPScan)
Who should worry
Any WordPress site running Contact Form 7 6.2 to 6.2.3 with at least one form that has a file upload field. Sites on Debian or Ubuntu with Apache are most at risk. Sites without a file upload field are less exposed, but should still update. (WPScan)
WordPress.org lists 10,000,000+ active installations. That is a plugin installation count, not a count of affected or compromised sites. (WordPress.org)
What to do now
- Update to 6.2.4 or later today, preferably the latest, 6.2.5. Back up the site and database first, then update the plugin through WordPress. (WPScan, WordPress.org)
- If the update has to wait, take file upload fields off your forms, or deactivate the plugin until you can update. Tell visitors how else to send you files in the meantime.
- Look for files that should not be there. Ask your developer or host to check the uploads folder, including the plugin's temporary folder
wp-content/uploads/wpcf7_uploads, for files ending in .php, .phar, .html or .svg that nobody on your team added. Updating closes the flaw; it does not remove files an attacker may already have placed. - Ask your host to turn off folder listing for your site if it is on. It is a one-line server setting, and the attack above relies on it.
What to send your developer, agency or host
Please check which version of Contact Form 7 our WordPress site runs. CVE-2026-114432 affects versions 6.2 to 6.2.3: an unauthenticated file upload through form file fields that leaves the file on disk, which can lead to remote code execution on Debian or Ubuntu Apache servers with directory listing and .phar handled as PHP. It is fixed in 6.2.4 (WordPress.org now lists 6.2.5). Please update today, check wp-content/uploads/wpcf7_uploads and the rest of uploads for unexpected .php, .phar, .html or .svg files, turn off directory listing if it is on, and confirm the version you left us on. Sources: WPScan, NVD, Contact Form 7.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and check the site, not proof of a break-in. The details go public on November 19, so do not wait.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow WPScan, the NVD entry and the plugin page on WordPress.org. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- WPScan: Contact Form 7 6.2 to 6.2.3, unauthenticated arbitrary file upload, fixed in 6.2.4, published November 5, 2026, proof of concept due November 19, 2026.
- NVD: CVE-2026-114432, published November 8, 2026, CVSS 9.8.
- Contact Form 7: 6.2.4 release announcement, October 29, 2026.
- WordPress.org: plugin version information (6.2.5, last updated November 10, 2026) and 10,000,000+ active installations.
- Contact Form 7: 6.2.5 release announcement, November 10, 2026.
- CISA: Known Exploited Vulnerabilities catalog, version 2026.11.10, checked November 11, 2026; CVE-2026-114432 not listed.