+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVEHosting

CVE-2026-114432: Contact Form 7 Unauth Upload - RCE on Stock Apache, Not Your nginx Box

By ServerGurus Team11 November 20269 min read
CVE-2026-114432: Contact Form 7 Unauth Upload - RCE on Stock Apache, Not Your nginx Box

CVE-2026-114432 is an unauthenticated arbitrary file upload in the WordPress plugin Contact Form 7 (contact-form-7) before 6.2.4. NVD, published 2026-11-08T06:17:04.807, last modified 2026-11-10T16:28:46.510. CNA: WPScan (contact@wpscan.com). CWE CWE-434 (CISA-ADP, Secondary). WPScan title on the vuln page: Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename. Publicly published there 2026-11-05. Fixed in 6.2.4.[1][2][3]

CISA-ADP CVSS 3.1 9.8 CRITICAL AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD Secondary, source 134c704f-…). NVD has no Primary metric in the JSON we pulled. WPScan’s plugin listing shows 7.5 (high) for the same row. Those are two scores for two outcomes - RCE vs leftover file - not a disagreement you can average.[1][4]

Vendor floor: 6.2.4, announced 2026-10-29T10:22:10+00:00. WordPress.org API this morning: stable 6.2.5, last_updated 2026-11-10 5:46am GMT, active_installs 10000000, requires WordPress 7.1 / PHP 8.3. The 6.2.5 changelog on that API is only a link; do not treat 6.2.5 as a second security release.[5][6]

CISA KEV catalog 2026.11.10 (count 1779, dateReleased 2026-11-10T19:03:29.8375Z) does not list this CVE. Not a 12 Nov KEV clock. Yesterday’s OpenSSH musl KEV is a different queue.[7]

This is not “every CF7 site is a webshell.” NVD and WPScan both split it: stock Debian/Ubuntu Apache with directory listing and .phar mapped to PHP → they call it RCE. nginx, or Apache with .htaccess overrides enabled → arbitrary file in uploads, which may still be served as HTML/SVG from the site origin. Typical WordPress vhosts need AllowOverride for permalinks; that is the second bucket, not the first. Patch anyway.[1][2]

What it is

Contact Form 7 takes files from a form [file] / [file*] field, attaches them to mail, then is supposed to delete the temp copy. Vendor 6.2.4 notes: in 6.2 through 6.2.3, multiple flaws in combination let an unauthenticated visitor upload a file that validation should have blocked and keep a file that cleanup should have removed. They name the reporters Shinya Murakami and Jakub Herman, via WPScan. WPScan’s own vuln page lists Shinya Murakami as original researcher / submitter, Verified Yes.[6][2]

NVD/WPScan mechanism, verbatim class: the plugin does not validate type or extension of files from that field, and a temporary-file cleanup flaw leaves the file on disk. WPScan’s title adds invalid UTF-8 filename as the bypass they named. Vendor 6.2.4 changelog matches that: wp_scrub_utf8() before UTF-8 regex, and wpcf7_antiscript_file_name() switched from an unsafelist to an extension safelist. Anything not on the safelist gets a safe extension. Default safelist is media + pdf + txt. Customize with wpcf7_file_extension_safelist. They also made wpcf7_unship_uploaded_file()’s second $options argument mandatory (third $uploaded_files by reference) - only relevant if you call that function yourself.[1][6]

Vendor scope sentence: Theoretically, all forms that have file uploading fields and are hosted on an HTTP server configured to list directory contents publicly can be a target. Forms without a file field are outside that sentence.[6]

We are not publishing an upload sequence. The GitHub compare v6.2.3...v6.2.4 is the vendor diff. That is enough for a host to know what changed. Do not treat this paragraph as a lab result from us.[8]

How serious is it?

On paper (CISA-ADP): network, no privileges, low complexity, high C/I/A - 9.8. That vector assumes the RCE outcome.[1]

On WPScan’s product table: 7.5 high. That is the number on wpscan.com/plugin/contact-form-7/ for this row as of the HTML we saved 11 Nov. It is not in the NVD metrics object.[4]

On NVD/WPScan wording: RCE only when all of these hold: leftover file on disk, directory listing so the random temp dir can be found, .phar executed as PHP. They name stock Debian or Ubuntu Apache. On nginx and on Apache with .htaccess overrides enabled, they limit it to an arbitrary file under uploads (HTML/SVG from the site origin). We did not dump /etc/apache2/apache2.conf on a customer box this morning; that split is their text.[1][2]

KEV / exploitation: not in catalog 2026.11.10. We have no CISA “evidence of exploitation” bar for this ID. Do not upgrade a third-party “PoC on date X” blog into a KEV due date.[7]

Install base: WordPress.org active_installs 10,000,000 is the directory bucket, including already-patched 6.2.4/6.2.5. It is not “10 million vulnerable sites.”[5]

Who is affected

Product / setup This bug? Floor / note
Contact Form 7 6.2, 6.2.1, 6.2.2, 6.2.3 Yes, vendor Floor 6.2.4. Current w.org stable 6.2.5.[6][5]
6.2.4 / 6.2.4.1 / 6.2.5 Vendor: not this vuln 6.2.4.1 is FormDataTree-PHP 2.0.10 only on the w.org changelog.[5]
Forms with no [file] / [file*] Outside vendor’s “theoretically” sentence Still update; the safelist is global.[6]
Stock Debian/Ubuntu Apache (Indexes + .phar → PHP) NVD/WPScan RCE path Deny listing; stop mapping .phar; patch.[1][2]
Apache + AllowOverride (typical WP permalinks) NVD: leftover file, not their RCE path Plugin .htaccess in the upload dir can apply. Patch anyway.[1]
nginx / LiteSpeed NVD: leftover file / origin HTML-SVG nginx ignores .htaccess. Block PHP under uploads.[1]
6.1.x and older Not in vendor 6.2-6.2.3 range NVD text is “before 6.2.4” with no CPE lower bound in the JSON (configurations was null). Vendor still says upgrade everyone for the safelist. Do not invent 6.1 as RCE.[1][6]
WordPress < 7.1 / PHP < 8.3 Cannot take the 6.2 line Plugin requires 7.1, requires_php 8.3. That is a core/PHP ticket, not this CVE’s floor.[5]
extensions-for-cf7 (CVE-2026-94589) Different slug HasThemes add-on. Do not grep only contact-form-7 and skip it, and do not confuse the two.[9]

What to do now

  1. Measure the slug, not the marketing name.
# version from the plugin header, no PHP bootstrap
grep -h '^[[:space:]]*\*[[:space:]]*Version:' \
  /home/*/public_html/wp-content/plugins/contact-form-7/wp-contact-form-7.php \
  /home/*/public_html/wp-content/plugins/contact-form-7/contact-form-7.php \
  2>/dev/null

# per-site
wp plugin get contact-form-7 --field=version --skip-plugins --skip-themes

Anything 6.2, 6.2.1, 6.2.2, 6.2.3 is in the vendor range. Ship ≥ 6.2.4. We used 6.2.5 as the w.org stable this morning.[6][5]

  1. Patch.
wp plugin update contact-form-7 --skip-plugins --skip-themes
wp plugin get contact-form-7 --field=version --skip-plugins --skip-themes

  1. If you cannot patch today: take file fields off the forms, or wp plugin deactivate contact-form-7. That is a compensating control, not a substitute for 6.2.4.[6]

  2. Stop PHP in uploads (needed on nginx even after the plugin .htaccess exists). Apache vhost example - apachectl configtest before reload:

<Directory /var/www/example.com/wp-content/uploads>
  Options -Indexes
  <FilesMatch "(?i)\.(php\d?|phar|phtml|pht)$">
    Require all denied
  </FilesMatch>
</Directory>
<Directory /var/www/example.com/wp-content/uploads/wpcf7_uploads>
  Require all denied
</Directory>

nginx: deny /wp-content/uploads/wpcf7_uploads and any .*\.(php\d?|phar|phtml)$ under uploads above your PHP location.

  1. Hunt leftovers, then the version. Look under wp-content/uploads/wpcf7_uploads/ and wp-content/uploads/ for unexpected .php / .phar / .phtml / odd HTML-SVG dated while 6.2-6.2.3 was live. We did not produce IOCs. “New executable under uploads” is the operator check, not a signature.

  2. After 6.2.4, test a real file field. Vendor changed the extension safelist. If you accepted .zip / .doc attachments, they now get rewritten unless you add them via wpcf7_file_extension_safelist. Confirm mail still attaches.[6]

Unsupported versions

The 6.2 line requires WordPress 7.1 and PHP 8.3. Sites stuck on 6.1 because of that requirement are outside the vendor 6.2-6.2.3 vuln sentence. They also cannot take 6.2.4 until core/PHP move. Vendor still recommends 6.2.4+ for the safelist on everyone who can run it. We are not assigning CVE-2026-114432 to 6.1.[5][6]

Compromise signs

NVD/WPScan do not publish IOCs. Operator checks:

  • Unexpected files under wp-content/uploads/wpcf7_uploads/ that survived a form submit (vendor: those should be gone after send).
  • .phar / .php / .phtml under wp-content/uploads/ from an unauthenticated POST era.
  • Directory listing on that path (the RCE finder they describe).
  • New admin users / must-use PHP you did not drop - not specific to this CVE; treat as generic post-RCE if the Apache .phar path was open.

Absence of those files is not proof you were never hit. Patch first.

FAQ

Is this yesterday’s SSHole KEV? No. CVE-2026-123158 is musl sshd. This is a WordPress plugin upload bug. Not in KEV catalog 2026.11.10.[7]

Is this CVE-2026-94589? No. That was Extensions For CF7 (extensions-for-cf7) ≤ 3.4.5. Different slug, patched 3.4.6, posted here 11 Oct.[9]

Do I need 6.2.5 or is 6.2.4 enough for this CVE? Vendor security floor is 6.2.4. 6.2.5 is current stable on w.org as of 2026-11-10 5:46am GMT. We did not fetch the 6.2.5 release notes body.[5][6]

Will wp plugin update break zip uploads? Vendor: non-safelist extensions are rewritten. .zip is not on the default list. Add it with the filter they published, then retest.[6]

Is every Apache host RCE? Only the configuration NVD named: listing and .phar as PHP. Many WP Apache vhosts set AllowOverride for permalinks; NVD puts those in the non-RCE bucket. Verify, do not assume either way.[1]

CISA 9.8 or WPScan 7.5? Cite both. 9.8 is CISA-ADP Secondary on NVD. 7.5 is WPScan’s plugin table. Primary NVD metric was absent in the JSON.[1][4]

Honesty

  • We did not submit a file to anyone’s form. No .phar was written by us.
  • CVSS 9.8 is CISA-ADP Secondary. WPScan 7.5 is from their plugin HTML, not NVD. Do not flatten to one number.[1][4]
  • RCE vs leftover-file is NVD/WPScan wording, not a test on our Debian/Ubuntu defaults this morning.
  • Not in KEV (catalogVersion 2026.11.10, 1779 entries). No exploitation claim from CISA for this ID.[7]
  • active_installs 10000000 is the WordPress.org bucket, including patched copies.[5]
  • NVD configurations was null in the REST object. Lower bound 6.2 is the vendor post, not a CPE row we parsed.[1][6]
  • WPScan vuln page (jina) listed Shinya Murakami only. Vendor names Jakub Herman as well. We kept both with sources.[2][6]
  • 6.2.5 announcement URL exists on w.org changelog; we did not pull that page. No claim about what 6.2.5 fixed.
  • GitHub compare is the vendor diff, not a third-party “mitigation repo.”

Sources

  1. NVD CVE-2026-114432 - published 2026-11-08T06:17:04.807; lastModified 2026-11-10T16:28:46.510; CNA WPScan; CISA-ADP 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; CWE-434; Apache .phar RCE vs nginx/AllowOverride leftover file
  2. WPScan vuln 6b0a5d1f-84fb-425f-8d37-ddde5703937c - title 6.2-6.2.3 invalid UTF-8 filename; publicly published 2026-11-05; last updated 2026-11-10; researcher Shinya Murakami; fixed 6.2.4
  3. GHSA-v95p-x24p-5c2m - published 2026-11-08T06:30:22Z; severity critical; CVSS 9.8
  4. WPScan plugin contact-form-7 - HTML saved 11 Nov 2026: CVSS 7.5 high; Fixed in 6.2.4; Published 2026-11-05; Active Installs 10000000; Last Updated November 10, 2026
  5. WordPress.org plugins API contact-form-7 - version 6.2.5; last_updated 2026-11-10 5:46am GMT; requires 7.1; requires_php 8.3; active_installs 10000000
  6. Contact Form 7 6.2.4 - 2026-10-29T10:22:10+00:00; vuln only 6.2-6.2.3; unauth upload + cleanup; Murakami and Herman via WPScan; safelist; wpcf7_unship_uploaded_file args
  7. CISA KEV JSON - catalogVersion 2026.11.10; count 1779; dateReleased 2026-11-10T19:03:29.8375Z; CVE-2026-114432 not present
  8. rocklobster-in/contact-form-7 compare v6.2.3...v6.2.4 - vendor changelog link
  9. CVE-2026-94589 (extensions-for-cf7), this blog 11 Oct 2026 - different plugin

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales