Answer in brief
CVE-2026-114432 records a Unknown severity vulnerability in Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename. The current sources do not mark it as known exploited. The current feed maps Unknown/Contact Form 7 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Contact Form 7 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Contact Form 7generic | >=6.2 <6.2.4 | 6.2.4 |
Published upstream
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 8, 2026
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is limited to an arbitrary file written into the uploads directory, which may still be served as active content such as HTML or SVG from the site's own origin.
Quoted source text, attributed separately from HOL analysis.