Tech News · Contact Form 7
Contact Form 7 vulnerability: what site owners should do now
“The PoC will be displayed on November 19, 2026, to give users the time to update.”
— WPScan, advisory for CVE-2026-114432
What happened
A Contact Form 7 vulnerability, tracked as CVE-2026-114432, lets anyone on the internet upload files to WordPress sites running Contact Form 7 versions 6.2 through 6.2.3, with no login required. The WordPress security database WPScan published the advisory on November 5, 2026, the official CVE record followed on November 8, and the fix is in Contact Form 7 6.2.4, which the developer, Rock Lobster Inc., released on October 29.
Contact Form 7 is one of the most widely used WordPress plugins, with more than 10 million active installations listed on WordPress.org. According to WPScan, the plugin did not check the type or extension of files sent through a form’s file-upload field, and a cleanup bug left those files sitting on the server. On a stock Debian or Ubuntu Apache setup that lists directory contents and runs .phar files as PHP, an attacker can find the uploaded file and run it as code — a full remote code execution. On other setups, such as nginx, the attacker can still drop arbitrary files (for example HTML or SVG pages) into the site’s uploads folder, served from the site’s own domain. CISA’s enrichment of the CVE record scores the flaw 9.8 out of 10 (critical).
As of November 9, the flaw was not on CISA’s list of actively exploited vulnerabilities, and no attacks had been publicly reported. That window is closing: WPScan says it will publish the proof-of-concept exploit on November 19, 2026. The developer has since shipped another update, Contact Form 7 6.2.5, on November 10, which is now the current version on WordPress.org.
FuzeForth’s take
This is the kind of WordPress security issue that hits small and mid-size businesses hardest. A contact form is on almost every business website, it is usually installed once and forgotten, and the people who own the site often don’t know which plugin powers it. A flaw that needs no password, sitting on a page you deliberately make public, is about as exposed as it gets.
The good news is that this one is simple to fix if you act before November 19. Once a working exploit is published, automated bots typically start scanning for unpatched sites quickly, and WordPress plugin flaws have been weaponized within hours of disclosure many times this year. Log in to your WordPress dashboard, open Plugins, and confirm Contact Form 7 shows 6.2.4 or later (6.2.5 is current). Turn on automatic updates for it. If you run several sites — or an agency or vendor runs them for you — ask for the exact installed version on each one, not a general “everything is up to date.”
Two extra steps are worth doing. First, ask your host or developer to make sure PHP files cannot run inside the uploads folder and that directory listing is off; that closes the path to code execution for this and similar bugs. Second, check the folders your forms upload to for files you don’t recognize, because updating the plugin does not remove anything that was already dropped there. If you would rather not track plugin patches and server hardening yourself, a managed WordPress maintenance and security plan handles this kind of update, backup and monitoring work for you. And if your site is stuck on old PHP or a patchwork of outdated plugins, it may be time for a website rebuild on a modern, secure stack.
Key points
- CVE-2026-114432 affects Contact Form 7 versions 6.2 to 6.2.3 and allows unauthenticated file uploads through form file fields.
- On some common Apache server setups, the flaw can lead to full remote code execution; elsewhere it still allows rogue files on your domain.
- The fix is Contact Form 7 6.2.4 or later; version 6.2.5, released November 10, 2026, is the current release.
- WPScan plans to publish proof-of-concept exploit code on November 19, 2026, so update before then.
- Also block PHP execution in the uploads folder, turn off directory listing, and check upload folders for unknown files.
Frequently asked questions
Is my site affected by the Contact Form 7 vulnerability?
Your site is affected if it runs Contact Form 7 version 6.2, 6.2.1, 6.2.2 or 6.2.3. The risk is highest if any of your forms include a file-upload field. Check the version under Plugins in your WordPress dashboard and update to 6.2.4 or later.
Has the Contact Form 7 flaw been exploited yet?
As of November 9, 2026, it was not listed in CISA’s catalog of actively exploited vulnerabilities and no attacks had been publicly reported. That can change quickly once WPScan publishes the exploit details on November 19, so don’t wait.
Why can’t I update Contact Form 7 on my site?
The Contact Form 7 6.2 series requires PHP 8.3 or higher and WordPress 7.1 or higher, so sites on older PHP will not show the update. The vulnerable versions are only 6.2 to 6.2.3, but staying on old PHP leaves you behind on future fixes; ask your host to upgrade PHP after testing your site.
