AI description
CVE-2026-114432 is a vulnerability affecting the Contact Form 7 WordPress plugin in versions prior to 6.2.4. The issue stems from a failure to validate the file types or extensions of files uploaded through form file fields, combined with a flaw in the plugin's temporary-file cleanup process. This combination allows unauthenticated users to upload arbitrary files and leaves them stored on the server's disk. The impact of this vulnerability depends on the server's configuration. On standard Debian or Ubuntu Apache setups that list directory contents and map `.phar` files to the PHP handler, the uploaded files can be located and executed, potentially leading to remote code execution. On other configurations, such as nginx or Apache with `.htaccess` overrides enabled, the vulnerability is limited to arbitrary files being written to the uploads directory, where they can still be served as active content like HTML or SVG from the site's origin.
- Description
- The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is limited to an arbitrary file written into the uploads directory, which may still be served as active content such as HTML or SVG from the site's own origin.
- Source
- contact@wpscan.com
- NVD status
- Received
CVSS 3.1
- Type
- Secondary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-434
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
21
ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-123551 (CVSS: 10) openidentity... CVE-2026-107331 (CVSS: 9.9) IBM CVE-2026-110963 (CVSS: 9.8) Unknown CVE-2026-114432 (CVSS: 9.8) Unknown CVE-2026-15266 (CVSS: 9.8) ibm ..🧵👇
@exploitgrid
9 Nov 2026
248 Impressions
0 Retweets
1 Like
0 Bookmarks
1 Reply
0 Quotes
Contact Form 7に未認証の任意ファイルアップロード脆弱性、環境によってはRCEの可能性【CVE-2026-114432】 #WordPress #ContactForm7 #脆弱性 #セキュリティ #CVE #サイバーセキュリティ #不正アクセス #WordPressセキュリティ #Ea
@Eatransform_net
8 Nov 2026
128 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🆕 New CVE: CVE-2026-114432 (CVSS 9.8, Enclave score 6/10) Unknown Contact Form 7 · Arbitrary file write Remote, no login needed. The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form… https://t.co/d5nKw88
@EnclaveRadar
8 Nov 2026
1284 Impressions
1 Retweet
12 Likes
4 Bookmarks
0 Replies
0 Quotes
🆕 New CVE Contact Form 7: remote code execution via unauthenticated form file upload (CVE-2026-114432) Unauthenticated visitors can upload arbitrary files that may run as code on common Apache setups. Patch → 6.2.4 https://t.co/O6CsCThZaL
@cvedotnow
8 Nov 2026
16679 Impressions
22 Retweets
131 Likes
65 Bookmarks
6 Replies
6 Quotes
🔴 Contact Form 7: Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename (CVE-2026-114432) Fix → 6.2.4 https://t.co/SxBQAIXq4H
@agentprime_io
8 Nov 2026
55 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Contact Form 7の6.2〜6.2.3に認証なしでファイルをアップロードされる脆弱性（CVE-2026-114432）：6.2.4で修正、確認する版と、公式が示した影響の条件 WordPressのプラグイン「Contact Form 7」の6.2から6.2.3に、認証なしの
@PNovavisio32590
8 Nov 2026
78 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes