Contact Form 7, the WordPress form plugin with 10+ million active installations, has a critical flaw in versions 6.2 to 6.2.3. The CVE record for CVE-2026-114432 was published on 8 November 2026; WPScan, which coordinated it, had listed it on 5 November. The fix is in 6.2.4, and WordPress.org now lists 6.2.5 as the current version.
What is wrong: the plugin does not validate the type or extension of files uploaded through a form's file field, and a bug in how it cleans up temporary files (triggered by an invalid UTF-8 filename, per WPScan's title) leaves the uploaded file on disk. So anyone, without logging in, can upload arbitrary files to a site that has a form with a file field.
When it becomes code execution: on a stock Debian or Ubuntu Apache setup, where directory listing is on and .phar files are handled as PHP, the uploaded file can be found and run, which means remote code execution. On other setups, such as nginx or Apache with .htaccess overrides, the file still lands in the uploads directory and may be served from the site's own domain as active content such as HTML or SVG.
Severity and status: CISA's ADP scores it CVSS 9.8 and marks it automatable; WPScan gives no score. No exploitation is reported so far, and the CVE is not in CISA's KEV catalog. WPScan says it will show a proof of concept on 19 November 2026 to give site owners time to update. The flaw was found by Shinya Murakami.
