External risk intelligence

Contact Form 7 Arbitrary File Upload Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-114432

The vulnerability affects Contact Form 7, a widely used WordPress plugin. Contact forms are designed to be public-facing and unauthenticated by default, meaning they are intended to receive input from any internet user. Because the flaw allows unauthenticated file uploads directly through these public-facing forms, the vulnerable surface is exposed to the internet in normal, standard deployments.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This issue affects a popular WordPress plugin, Contact Form 7, and allows unauthenticated users to upload arbitrary files to a website. In some configurations, these uploaded files can be executed, potentially leading to the compromise of the entire website.

Website forms can be tricked into accepting dangerous files.
Publicly accessible forms create broad exposure.
Confirm plugin relevance and exposure risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload arbitrary files to a WordPress site by exploiting a weakness in the Contact Form 7 plugin's file handling. This vulnerability can then lead to remote code execution on servers with specific configurations, or allow for arbitrary file writes that could be exploited in other ways on different server setups.

Publicly accessible form without authentication.
Uploading a specially crafted file.
Arbitrary code execution or file inclusion.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to upload arbitrary files to a WordPress site. In certain configurations, these files could be executed, leading to remote code execution. In other setups, the uploaded files might be served as active content from the site.

Arbitrary files could be uploaded.
Via unauthenticated form uploads.
Leading to code execution or content injection.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a popular WordPress plugin requires immediate attention from platform and application owners. The first step is to identify all WordPress sites using the affected plugin, confirm their exposure and business criticality, and then assign ownership for remediation.

Platform and application owners responsible.
Verify plugin usage and site exposure.
Plan coordinated remediation and mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Contact Form 7 plugin?

Contact Form 7 is a widely installed WordPress plugin that enables site owners to create and manage custom contact forms. These forms allow visitors to submit inquiries or upload documents directly through a website, acting as a bridge between public users and the site's backend storage.

What does CVE-2026-114432 mean?

This vulnerability is classified as CWE-434, or Unrestricted Upload of File with Dangerous Type. It occurs because the plugin fails to check what kind of file is being uploaded. By bypassing these checks, an unauthenticated user can place files on the server that the system mistakenly treats as trusted content or executable code.

How can an attacker trigger this bug?

An attacker exploits this by sending a specially crafted file through a form that uses the plugin. The issue is not triggered by administrative actions but by public interaction. Notably, simply having the plugin installed does not cause the flaw; the form must be active and accessible, allowing the malicious upload to persist on the server disk.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is highly likely to affect your environment because contact forms are inherently designed to be public-facing. Since the plugin allows unauthenticated file uploads, any internet-connected form using older versions of Contact Form 7 serves as an open entry point for an attacker.

How should I respond to this vulnerability?

First, audit your WordPress installations to identify any sites running Contact Form 7 versions before 6.2.4. Once identified, prioritize updating the plugin to the latest version to secure file handling. If you cannot update immediately, consider disabling file upload features within your forms to mitigate the risk of arbitrary file placement.

References

wpscan.com/vulnerability/6b0a5d1f-84fb-425f-8d37-ddde5703937c/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.