The CVE record says the plugin does not validate uploaded file types, and a cleanup flaw leaves the file on disk. On a stock Debian or Ubuntu Apache server, the file can then run as PHP. CISA's Vulnrichment program scores it CVSS 3.1 9.8 Critical, and the maintainers fixed it in version 6.2.4.
What it allows
CVE-2026-114432 is a flaw in how Contact Form 7 stores files uploaded through a form's file field. The CVE record says the plugin does not check the type or extension of an uploaded file before accepting it.
The record adds that a separate flaw in the plugin's temporary-file cleanup leaves the uploaded file on disk instead of removing it. No account or form submission limit stops the upload, so the flaw is reachable by any visitor.
What CVE-2026-114432 Lets an Attacker Do
The CVE record says the impact depends on the server's own configuration. On a stock Debian or Ubuntu Apache setup, directory listing is on and the .phar extension maps to the PHP handler. An attacker can then find the stored file and run it, reaching remote code execution.
On other configurations, including nginx and Apache with .htaccess overrides enabled, the record says the issue is limited to an arbitrary file written into the uploads directory. That file may still be served as active content, such as HTML or SVG, from the site's own origin.
WPScan credits Shinya Murakami as the researcher who found and submitted the flaw. WPScan says it will publish proof-of-concept detail on 19 November 2026, after giving site owners time to update.
How the Score Reads
CISA's Vulnrichment program scores CVE-2026-114432 CVSS 3.1 9.8 Critical, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD lists this as a secondary source; WPScan, the CNA, gives no CVSS score of its own in the record. There is no CVSS 4.0 score in the record or NVD.
The CVE record, from WPScan, assigns CWE-434, unrestricted upload of file with dangerous type. CISA's Vulnrichment program's own SSVC scoring classifies exploitation for CVE-2026-114432 as none and marks the flaw automatable, as of 8 November 2026. See our CVSS entry for how to read the score.
What WPScan and CISA KEV Say
WPScan's own vulnerability database entry lists the flaw as fixed in Contact Form 7 6.2.4, and names versions 6.2 up to 6.2.3 as affected. That entry was added 5 November 2026 and last updated 7 November 2026, ahead of the CVE record's own 8 November 2026 publication.
CVE-2026-114432 is not in the CISA Known Exploited Vulnerabilities catalogue, version 2026.11.06. Our KEV glossary entry explains the catalogue.
Who is affected
The CVE record lists Contact Form 7 versions 6.2 up to 6.2.3 as affected, and names 6.2.4 as the fixed version. WPScan's own vulnerability database entry agrees on the same affected range and fix.
Contact Form 7 is a WordPress plugin with more than 10 million active installs, per the WordPress.org plugin directory. Any site running an affected 6.2.x release needs the update in the table above.
The flaw is a case of our Exploit Public-Facing Application technique. No account is needed, and the CVE record describes it as reachable over the network.
Timeline
- 5 Nov 2026
WPScan adds the vulnerability database entry, crediting Shinya Murakami as the researcher.
- 7 Nov 2026
WPScan last updates its entry, ahead of the CVE record's own publication.
- 8 Nov 2026
WPScan, the CNA, publishes CVE-2026-114432, and NVD publishes its own entry the same day.
- 19 Nov 2026
WPScan says it will publish proof-of-concept detail on this date.
What to do
-
Update to Contact Form 7 6.2.4
Move every site running Contact Form 7 6.2 through 6.2.3 to 6.2.4 or later, the version the CVE record and WPScan's advisory both name as fixed.
-
Check the Uploads Directory for Unexpected Files
We recommend reviewing the plugin's upload folder for files with unexpected names or extensions, especially .phar files, since the record says the cleanup flaw can leave them in place.
-
Harden Directory Listing and Handler Mapping
The CVE record names a stock Debian or Ubuntu Apache setup, with directory listing on and .phar mapped to the PHP handler, as the path to code execution. We recommend turning off directory listing and removing any handler mapping for upload-reachable folders.
-
Watch for the 19 November Proof-of-Concept
WPScan says it will publish proof-of-concept detail on 19 November 2026. We recommend confirming every affected site is updated before that date.
-
Treat Unauthenticated Form Endpoints as Public-Facing
The flaw needs no account, so we recommend treating every Contact Form 7 install as reachable by any visitor when you prioritize the update.
Frequently Asked Questions
Which Contact Form 7 versions does CVE-2026-114432 affect?
The CVE record and WPScan's own vulnerability database entry both list versions 6.2 up to 6.2.3 as affected, with 6.2.4 as the fixed release.
Does an attacker need an account to exploit CVE-2026-114432?
No. The CVE record describes an unauthenticated attacker uploading the file through the plugin's own form field.
Does CVE-2026-114432 always lead to remote code execution?
No. The CVE record says that outcome needs a stock Debian or Ubuntu Apache setup with directory listing on. Other setups are limited to a file written into the uploads directory.
Who scored CVE-2026-114432 as CVSS 9.8?
CISA's Vulnrichment program gives the CVSS 3.1 score of 9.8 Critical. WPScan, the CNA, lists no CVSS score of its own in the record.
Is CVE-2026-114432 in the CISA KEV catalogue?
It is not in catalogue version 2026.11.06. CISA's own Vulnrichment data lists the flaw's exploitation status as none.
Sources
- CVE-2026-114432 RecordCVE Program / WPScan CNA
- CVE-2026-114432NVD
- WPVDB 6b0a5d1f-84fb-425f-8d37-ddde5703937c, Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 FilenameWPScan
- Contact Form 7WordPress.org Plugin Directory
- Known Exploited Vulnerabilities CatalogCISA
