{"id":12510,"date":"2026-11-10T13:36:54","date_gmt":"2026-11-10T19:36:54","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-150-unauthenticated-file-upload-in-contact-form-7\/"},"modified":"2026-11-10T13:40:13","modified_gmt":"2026-11-10T19:40:13","slug":"alert-2026-150-unauthenticated-file-upload-flaw-in-contact-form-7","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-150-unauthenticated-file-upload-flaw-in-contact-form-7\/","title":{"rendered":"Alert 2026-150 Unauthenticated file upload flaw in Contact Form 7"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td><\/tr>
Contact Form 7 (WordPress plugin)<\/strong><\/td>6.2, 6.2.1, 6.2.2 and 6.2.3<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The fix for CVE-2026-114432 is in 6.2.4 (Oct 29, 2026); 6.2.5, which includes it, is recommended. Versions 6.1.x and earlier are not in the affected range. Practical exploitation requires a file upload field in the form.<\/p>\n\n

Description<\/h2>\n\n

An unauthenticated arbitrary file upload vulnerability (CWE-434) has been published in Contact Form 7, a WordPress form plugin with more than 10 million active installations. The vulnerability has been assigned CVE-2026-114432 and affects versions 6.2 through 6.2.3. An attacker without credentials can cause a form with an attachment field to accept a file that validation should block and have that file remain on the server.<\/p>\n\n

The vendor stated that the issue affects only that range and released the fix on Oct 29, 2026 in version 6.2.4. Researchers point out that, in a stock Debian or Ubuntu Apache configuration\u2014with directory listing enabled and the .phar<\/code> type associated with PHP\u2014the file can be located and executed, opening the door to remote code execution. In other configurations, including nginx and Apache with .htaccess<\/code> overrides, the impact is limited to a write in the uploads directory, which can still be served as HTML or SVG directly from the site.<\/p>\n\n

The sources do not agree on the score, and the CNA did not publish one of its own. Enrichment of the CVE record rates it CVSS 9.8, critical, while industry researchers score it CVSS 8.1, high, and CVSS 7.5, high, partly because the random upload subdirectory is not disclosed and because code execution depends on the server configuration. It should be treated as critical when the server can list and execute uploaded files, and as high in all other configurations. The 9.8 rating is not presented as a consensus or as the vendor’s score.<\/p>\n\n

No confirmed exploitation has been identified so far. The vulnerability is not listed in catalogs of known exploited vulnerabilities. Researchers announced a proof of concept for Nov 19, 2026 to allow time to update; as of Nov 10, 2026, it was not public. On Nov 10, 2026 at 02:46 (PYT), the vendor released version 6.2.5, which includes the fix for this flaw and also closes two lower-risk information leaks whose severity the vendor says is not high.<\/p>\n\n

Mitigation<\/h2>\n\n

Recommended:<\/p>\n\n