EUVD-2026-119468
GHSA-v95p-x24p-5c2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify CF7 form with file field
-
DeliverySubmit form with malicious .phar/HTML file
-
ExploitCleanup flaw persists file in uploads dir
-
ExecutionBrowse listable directory to locate file
-
PersistRequest file so Apache PHP handler executes it
-
ImpactRemote code execution as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable feature is a Contact Form 7 form that includes a file-upload field; the plugin fails to validate uploaded file type/extension and a temporary-file cleanup flaw leaves the file on disk, so no authentication, user interaction, or special submission state is required to write an arbitrary file (AV:N/AC:L/PR:N/UI:N). Escalation to Remote Code Execution specifically requires the server to run a stock Debian/Ubuntu Apache configuration that both lists directory contents (so the stored file can be located) and maps .phar to the PHP handler (so it executes). LIMITING factors: on nginx, or Apache with .htaccess overrides enabled, RCE does not occur and impact is reduced to an arbitrary file written into the uploads directory that may still be served as same-origin active content (HTML/SVG); the deployed plugin version must be in the 6.2 branch below 6.2.4, and a form must expose a file-upload field. |
| Impact | Signals are mixed but lean toward genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full C/I/A impact, and the vuln.today Decision label is act_now - consistent with a critical unauthenticated file-upload bug (CWE-434) in a very widely deployed WordPress plugin. However, the EPSS score is low (0.21%, 12th percentile), the CVE is NOT listed in CISA KEV, and the exploit is a reference only, not verified as working code. The 9.8 also assumes worst-case outcome: full RCE is explicitly conditional on a stock Debian/Ubuntu Apache configuration (directory listing enabled plus .phar mapped to the PHP handler); on nginx or Apache with .htaccess overrides the impact degrades to an arbitrary file written to the uploads directory that may still be served as same-origin active content (HTML/SVG). So the headline RCE severity is real for one common default but not universal - treat the raw 9.8 as a conditional maximum. Net: a real, actionable priority given the act_now label, trivial exploitation path, and plugin ubiquity, but not yet evidence of mass exploitation (low EPSS, no KEV, unverified PoC), suggesting opportunity exists but widespread weaponization is not yet confirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a Contact Form 7 form that contains a file-upload field and attaches a malicious file (e.g. a .phar PHP payload, or an HTML/SVG file); the broken temporary-file cleanup leaves the file persisted in the site's uploads directory. On a stock Debian/Ubuntu Apache server the attacker browses the listable uploads directory, locates the stored .phar, and requests it so Apache's PHP handler executes it, yielding remote code execution. A public PoC reference exists (WPScan) but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 08, 2026
Unauthenticated arbitrary file upload in the Contact Form 7 WordPress plugin (6.2 branch below 6.2.4) lets any visitor who submits a form containing a file-upload field write attacker-chosen files into the site, because the plugin neither validates file type/extension nor reliably removes the temporary upload from disk. Escalation to remote code execution is configuration-dependent: it requires a stock Debian/Ubuntu Apache setup that both lists directory contents (so the stored file can be located) and maps .phar to the PHP handler; on nginx, or Apache with .htaccess overrides enabled, the outcome is limited to an arbitrary file in the uploads directory that may still be served as same-origin active content such as HTML or SVG. A public PoC reference exists but is not verified as working exploit code, EPSS is low at 0.21% (12th percentile), and no CISA KEV entry indicates active exploitation, yet the internal priority decision is act_now given the unauthenticated RCE path on common Debian/Ubuntu Apache deployments.
RemediationAI
Vendor-released patch: upgrade the Contact Form 7 plugin to 6.2.4 or later; this is the only complete fix, because the plugin's missing upload validation and broken temporary-file cleanup are corrected in that release, and any configuration-level workaround leaves the arbitrary file write in place. Because the RCE escalation depends on two server behaviours named in the advisory, environments that cannot patch immediately should remove both: disable directory content listing for the uploads path (for example an Apache Options -Indexes directive) so a stored file cannot be enumerated, and stop mapping the .phar extension to the PHP handler so a written .phar is served as an inert file rather than executed. The trade-off is that these changes are server-wide and may break legitimate applications that rely on index listings or on .phar being executed. Sites on nginx, or on Apache with .htaccess overrides enabled, should not assume they are safe: RCE is not reachable there, but an arbitrary file still lands in the uploads directory and can be served as same-origin HTML or SVG, so uploads-directory response handling should also be reviewed. Confirm the deployed plugin version is outside the 6.2 branch below 6.2.4 and consult https://wpscan.com/vulnerability/6b0a5d1f-84fb-425f-8d37-ddde5703937c/ for the vendor advisory detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-434 (Unrestricted Upload of File with Dangerous Type) in Contact Form 7's form file-field handling: the plugin accepts uploads without checking the file type or extension, and a defect in its temporary-file cleanup leaves the uploaded artifact on disk instead of discarding it, turning a transient submission into a persistent file written under the WordPress uploads directory. Persistence alone does not yield code execution - it depends on the web server's handling of that directory. On a stock Debian or Ubuntu Apache configuration, directory content listing allows the attacker to locate the written file, and the packaged PHP module configuration maps the .phar extension to the PHP handler, so a crafted .phar is executed by the interpreter; PHP's phar stream wrapper makes files with that extension meaningful even outside a normal .php request. On nginx, or Apache where .htaccess overrides are enabled (permitting an uploads-directory rule that blocks script execution), the interpreter path is not reachable, and the residual impact is an attacker-controlled file stored on the origin, which can still be rendered as active content (HTML or SVG) from the site's own origin. The trigger therefore combines three preconditions: a deployed plugin version in the 6.2 branch below 6.2.4, a published form exposing a file-upload field, and - for RCE specifically - the permissive Apache directory-listing plus .phar-handler combination.
Know when Contact Form 7 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote upload is reliably low-complexity (AV:N/AC:L/PR:N/UI:N); full C/I/A impact reflects the RCE outcome on the common default Debian/Ubuntu Apache configuration described.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is limited to an arbitrary file written into the uploads directory, which may still be served as active content such as HTML or SVG from the site's own origin.
Articles & Coverage 1
Technical POC Analysis
The bug class is CWE-434: Unrestricted Upload of File with Dangerous Type.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-114432 is a critical vulnerability in the Contact Form 7 WordPress plugin (6.2 branch before 6.2.4) that allows unauthenticated attackers to upload arbitrary files to the web server. While exploitation requires specific server configurations for remote code execution, the vulnerability affects any organization using the plugin-potentially impacting website integrity, data confidentiality, and customer trust. Leadership should prioritize remediation due to the unauthenticated attack vector and the plugin's widespread use.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Contact Form 7
View allThe Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter i
The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote cod
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a reques
Open redirect vulnerability in Contact Form 7 WordPress plugin prior to version 2.5 allows unauthenticated attackers to
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation
The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via th
Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit a
The Contact Form 7 - Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in al
Drag and Drop Multiple File Upload for Contact Form 7 (WordPress plugin) is affected by missing authorization (CVSS 3.7)
Exploit-DB