CVE-2026-114432: RCE in Contact Form 7 via File Upload

CVE-2026-114432 affects Contact Form 7, one of WordPress's most widely deployed contact form plugins. The vulnerability stems from a lack of validation on file type and extension for files uploaded through form file fields. A flaw in the temporary file cleanup mechanism also leaves uploaded files persisting on disk. This allows unauthenticated users to upload arbitrary files to the site.

The impact depends on server configuration. On standard Debian and Ubuntu Apache installations that list directory contents and map the .phar extension to the PHP handler, the uploaded file can be located and executed, leading to full Remote Code Execution (RCE). On other setups, such as nginx or Apache with .htaccess overrides enabled, risk is constrained to arbitrary files written to the uploads directory, though they may still be served as active content (HTML, SVG) from the application's origin.

To defend: 1) Update Contact Form 7 to version 6.2.4 or later immediately. 2) Review your server configuration (directory listing, MIME mapping, /uploads permissions). 3) Audit recently uploaded files in the uploads folder for suspicious activity. 4) If immediate patching is impossible, disable forms with file fields until you can apply the fix. The patch is available now—do not delay.