{"id":"CVE-2026-114432","published":"2026-11-08T06:17:04.807","lastModified":"2026-11-10T16:28:46.510","description":"The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is limited to an arbitrary file written into the uploads directory, which may still be served as active content such as HTML or SVG from the site's own origin.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/6b0a5d1f-84fb-425f-8d37-ddde5703937c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Unpatched versions of the Contact Form 7 WordPress plugin (before 6.2.4) fail to validate file uploads and leave temporary files on disk due to flawed cleanup, enabling unauthenticated users to upload arbitrary files. On Apache with default Debian/Ubuntu configurations that expose directory listings and map .phar to PHP, these files can be located and executed as code, achieving remote code execution. On other servers (e.g., nginx or Apache with .htaccess), the flaw still permits writing arbitrary files into the uploads directory, potentially leading to execution via HTML/SVG if served as active content.","exploitability":"Exploitation is straightforward for unauthenticated attackers on vulnerable Apache configurations with directory listing enabled and .phar handler configured; on other setups, it requires additional reconnaissance or social engineering to trigger file execution.","blast_radius":"Successful exploitation grants full remote code execution with the privileges of the web server process, enabling complete site compromise, data theft, lateral movement, or defacement across all WordPress sites using unpatched Contact Form 7 versions.","remediation":"Upgrade Contact Form 7 to version 6.2.4 or later immediately; if immediate patching is not possible, disable file upload fields in all forms and restrict write access to the uploads directory via server configuration.","detection":"Defenders should monitor Apache access logs for requests to unexpected .phar files in wp-content/uploads/ (e.g., GET /wp-content/uploads/2024/05/*.phar HTTP/1.1), especially with directory listing enabled, and inspect filesystem for orphaned .phar or other executable files in upload directories not associated with legitimate plugin/theme activity.","tags":["rce","file-upload-bypass","webapp","unauth-access","wordpress"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:43:10.676Z"}}