+61 2 9043 1246

Knowledge base

The Contact Form 7 file upload flaw: the WordPress form plugin bug fixed in 6.2.4, explained for website owners

Published · By , Co-Founder, BLACKBX

Contact Form 7 versions 6.2 to 6.2.3 let a stranger, with no login, get files onto a WordPress site’s server that the form should have refused. It affects sites with a file upload field in a form. No attacks have been reported so far. Update to 6.2.4.1, the current release.

Key fact Advisory
What An unauthenticated arbitrary file upload in how Contact Form 7 checks and clears files attached to forms. CWE not published.
Affected Contact Form 7 6.2, 6.2.1, 6.2.2 and 6.2.3. Versions before 6.2 (such as the 6.1 series) are not affected, per the vendor.
Fixed in 6.2.4, released 29 October 2026. The latest version today is 6.2.4.1.
Severity No confirmed score. There is no CVE, so no NVD score, and the vendor gives none.
Needs a login? No. The vendor and Patchstack both describe it as unauthenticated.
Exploited? Not known. No reports of attacks and no public proof-of-concept found as of 6 November 2026, and no CISA KEV listing found.
Do now Check the Contact Form 7 version in your WordPress dashboard and update to 6.2.4.1.

Facts checked on 6 November 2026 against the Contact Form 7 6.2.4 and 6.2 announcements, the WordPress.org and WordPress.com plugin pages, and Patchstack. Sources are listed at the end.

What is the Contact Form 7 file upload flaw?

Contact Form 7 is a WordPress plugin: an add-on that gives a WordPress site a feature it doesn’t have out of the box. This one adds contact forms. Some of those forms include a field where a visitor can attach a file, such as a résumé, a photo or a document for a quote. WordPress.org lists it at more than 10 million active installations. It is written by Takayuki Miyoshi, founder and CEO of Rock Lobster Inc.

The flaw sits in the way the plugin handles files attached to forms. The vendor describes it as “an unauthenticated arbitrary file upload”. Unauthenticated means the person doesn’t need to log in. Arbitrary file upload means they can put a file of their own choosing onto your web server. According to the vendor, several weaknesses can be combined to “upload files that should normally be blocked by validation logic and keep files that should normally be removed immediately after submission”.

In plain terms, the plugin is meant to do two things with every attachment: refuse the kinds of file it shouldn’t accept, and clear uploads away once the form has been sent. In versions 6.2 to 6.2.3, a stranger could get past both safeguards.

The flaw was found by Shinya Murakami and Jakub Herman and reported through WPScan, a database of WordPress vulnerabilities. The date they reported it has not been published. The fix, version 6.2.4, was released on 29 October 2026.

No CVE has been assigned. A CVE is the public reference number most vulnerabilities receive, which is why we refer to this one by product and flaw instead.

Who is affected?

The vendor says: “Theoretically, all forms that have file uploading fields and are hosted on an HTTP server configured to list directory contents publicly can be a target.” Put together, a site is in scope when all of these are true:

  1. The site runs WordPress with Contact Form 7 installed.
  2. The plugin is on version 6.2, 6.2.1, 6.2.2 or 6.2.3.
  3. At least one form on the site has a file upload field.
  4. The web server is set to list folder contents publicly. That means when someone visits the address of a folder on your site, the server shows a list of the files inside it, instead of a page or an error. Whether your server does this is something your host can tell you.

What is not affected:

  • Versions before 6.2, including the 6.1 series. The vendor says the flaw “is seen only in Contact Form 7 6.2 to 6.2.3”. Patchstack lists the same range.
  • Forms with no file upload field, on the vendor’s description of what can be a target.
  • A different plugin with a similar name. “Drag and Drop Multiple File Upload – Contact Form 7” is made by a different developer and has had its own file upload flaws in the past. None of them is this flaw, and this flaw is in Contact Form 7 itself.

Version 6.2 came out on 6 October 2026, so the affected versions were the current release for just over three weeks. Version 6.2 also raised the minimum PHP version from 7.4 to 8.3 (PHP is the programming language WordPress runs on). Sites on an older PHP version may still be on 6.1.x, which falls outside the affected range. The vendor still recommends 6.2.4 for everyone, “since the security enhancements apply to all versions of the plugin”. If your server’s PHP version is what’s holding the plugin back, our post on PHP 8.2 reaching end of life covers that side of it.

The folder listing condition matters, but it isn’t a reason to skip the update. It is a server setting, it can change when a site moves host or a server is rebuilt, and most owners have never had cause to ask about it.

If your site uses Contact Form 7 and any of your forms accept attachments, assume you are in scope until someone checks the version.

What can an attacker do?

Put files on your web server that your site was built to refuse, and have them stay there. The vendor has not published more detail about what such a file could then be used for, and we won’t speculate. A stranger’s file sitting on your server, past the checks meant to stop it, is the problem in itself.

Three things make it worse:

  • No login needed. The person doesn’t need an account on your site. Anyone who can reach the form can try.
  • The door is on a public page. Contact forms are built to be found. They sit on your contact page, your careers page or your quote page, where any visitor can use them.
  • The plugin is everywhere. With more than 10 million active installations, sites running the affected versions are not hard to come across.

On severity: we haven’t been able to confirm a published score. Severity scores normally use CVSS, the Common Vulnerability Scoring System, which rates flaws from 0 to 10. Because there is no CVE, the US National Vulnerability Database (NVD) has not scored it. The vendor gives no score. Patchstack lists the flaw, but we did not find a score in its listing. We will not repeat a number we have not been able to check.

What the vendor does say is enough to act on: no login is needed, and the result is files on your server that should never have been there.

Is it being exploited?

As of 6 November 2026, we found no reports of this flaw being used in attacks. We also found no public proof-of-concept, which is working attack code published for anyone to use. Our searches were not exhaustive, so read that as “nothing found”, not “confirmed safe”.

We also found no listing for it in CISA’s Known Exploited Vulnerabilities (KEV) catalogue. CISA is the US government’s cybersecurity agency, and KEV is its list of flaws with evidence of real attacks.

For an Australian site, the absence of reports is not an all-clear. The fix has been public since 29 October 2026, and the vendor’s announcement explains which forms are at risk. Once a fix is public, anyone can compare the old version with the new one. Australian sites run the same plugin as everyone else, and nothing about where a site is hosted takes it out of scope.

The practical reading: there is no sign of a wave of attacks, the fix is available, and the update is the cheapest thing you will do this week.

What should you do now?

In this order:

  1. Find out the version. In the WordPress dashboard, go to Plugins > Installed Plugins and find Contact Form 7. The version number is listed under its name. If it shows 6.2, 6.2.1, 6.2.2 or 6.2.3, your site is running an affected version.
  2. Update. Update Contact Form 7 to 6.2.4.1, the current release. The vendor recommends 6.2.4 or later “for all users”, whatever version they are on. The fixed versions need WordPress 7.1 or higher and PHP 8.3 or higher, so if the update isn’t offered, that is usually why, and your host or developer will need to raise one or both first.
  3. Test your forms. After updating, send a test through every form, especially any with an upload field. The vendor has changed how attachments are checked: file names are now checked against a list of allowed file types, instead of a list of blocked ones. A file with a type not on the allowed list has its extension changed to a safe one automatically. If your forms accept unusual file types, your developer may need to add them. If any custom code on the site uses the plugin’s internal function wpcf7_unship_uploaded_file(), that function now works differently. A third-party developer also reported an empty file field bug in 6.2.4, which they say 6.2.4.1 fixes, which is one more reason to go straight to 6.2.4.1.
  4. Check your exposure. Note which forms accept attachments. Ask your host whether your server lists folder contents publicly, and if it does, whether that can be turned off. That step is our advice, not the vendor’s.
  5. Check for compromise. The vendor has not published signs to look for. If your site ran 6.2 to 6.2.3 with an upload form, our advice is to have your developer or host look through the files the site stores for anything that shouldn’t be there, particularly files that aren’t the kind your forms are meant to accept.
  6. If you find something. Don’t just delete it and move on. Have your developer or host work out what it is and how long it has been there. Restoring from a clean backup taken before the file appeared, and changing the passwords for WordPress, your hosting account and the database, are sensible steps. Again, that is our advice: the vendor hasn’t published clean-up guidance.
  7. Record what you did. Write down the date, the version you moved from and to, and what you checked. If a question comes up later from a client, an insurer or your own team, you’ll have the answer.
  8. Reduce exposure. If a form has an upload field nobody uses, remove it. If a plugin is installed but not doing anything, remove that too. Every public upload field is a way in, and fewer of them means fewer things to watch.

If you can’t find the version, or you’d rather someone else checked, that’s what we do. Details at the bottom.

Why updating is not the whole fix

Version 6.2 was released on 6 October 2026. The fix arrived on 29 October 2026. A site that took 6.2 when it came out and hasn’t updated since has been running an affected version for a month, and every day it stays that way adds to the total.

The update closes the gap for the future. It does nothing about the weeks before it was installed, and it does not remove anything that was uploaded in that time. The vendor’s own description includes files that “should normally be removed immediately after submission” staying on the server. If such a file is there, it stays there after the update until someone finds it.

That is why step 5 above matters for any site that ran an affected version with an upload form. The update is the lock on the door. Checking the files is making sure nobody came in while it was open.

There is also the question of who would have noticed. On most business websites, the host looks after the server: the hardware, the operating system, keeping it running. The people who built the site have other work on, and once the site launched, they moved to the next project. And in many cases, nobody has been told that the plugin updates are theirs. Each party reasonably assumes someone else has it covered. A form plugin is exactly the kind of thing that falls between them, because it works perfectly well right up until the day it doesn’t.

That is the pattern with most WordPress plugin flaws. The fix appears in a changelog, the update notice sits in the dashboard, and whether it gets applied depends on whether anyone is actually watching the site.

What this looks like with BLACKBX

BLACKBX reads the exact software versions on every site it looks after each night, and checks new security advisories against them every hour, with WordPress plugin and theme advisories checked daily. When a client’s site matches a critical advisory, our developers patch it immediately. Lower-severity items are done at the next service. Every update is dated and recorded in the client’s security logbook, so there is always a record of what changed and when.

On the Monitor plan, the finding goes to the client’s own developer, with the version numbers and our advice, so the people who know the site can act on it. On Maintenance and Full service, BLACKBX does the work. Plans are monthly, with no minimum term.

Timeline

Date Event
6 October 2026 Contact Form 7 6.2 released, the first affected version. It raises the minimum PHP version to 8.3.
29 October 2026 Contact Form 7 6.2.4 released with the fix, and the vendor’s announcement published, crediting Shinya Murakami and Jakub Herman via WPScan.
29 October 2026 Contact Form 7 6.2.4.1 released, according to WordPress.com’s “Last updated” date.
Early November 2026 Patchstack lists the flaw in its database, covering versions 6.2 to 6.2.3.
6 November 2026 This article published.

Sources

Common questions

Is my site affected by the Contact Form 7 file upload flaw?

Your site is affected by the Contact Form 7 file upload flaw if it runs Contact Form 7 version 6.2, 6.2.1, 6.2.2 or 6.2.3. The vendor says the forms at risk are those with a file upload field on a server set to list folder contents publicly. You can see the version under Plugins > Installed Plugins in WordPress. BLACKBX reads the exact plugin versions on every site it looks after each night, so clients’ sites are checked against this advisory automatically.

Which version of Contact Form 7 fixes the file upload flaw?

Contact Form 7 6.2.4, released on 29 October 2026, fixes the file upload flaw. The current release is 6.2.4.1, which is the version to install. It needs WordPress 7.1 or higher and PHP 8.3 or higher. On BLACKBX’s Maintenance and Full service plans, our developers apply updates like this and record each one, dated, in the client’s security logbook.

Does the Contact Form 7 file upload flaw have a CVE number?

No. As of 6 November 2026, no CVE has been assigned to the Contact Form 7 file upload flaw, which is why it is referred to by product and flaw. The vendor’s announcement and Patchstack’s listing both describe it as an unauthenticated arbitrary file upload in versions 6.2 to 6.2.3. BLACKBX checks new security advisories against its clients’ sites every hour, whether or not they carry a CVE number.

Is the Contact Form 7 file upload flaw being exploited?

As of 6 November 2026, we found no reports of the Contact Form 7 file upload flaw being used in attacks, no public proof-of-concept and no listing in CISA’s Known Exploited Vulnerabilities catalogue. That is not a guarantee, because the fix has been public since 29 October 2026. When a client’s site matches a critical advisory, BLACKBX’s developers patch it immediately rather than waiting for attacks to be reported.

I’m on Contact Form 7 6.1. Do I need to update?

The vendor says the Contact Form 7 file upload flaw is only in versions 6.2 to 6.2.3, so 6.1 is outside the affected range. The vendor still recommends 6.2.4 or later for everyone, because its security improvements apply to all versions. Those versions need PHP 8.3, so a site on older PHP may need its server updated first. On BLACKBX’s Monitor plan, findings like this go to your own developer with the version numbers and our advice.

Will updating Contact Form 7 break my forms?

Updating to fix the Contact Form 7 file upload flaw changes how attachments are checked: file types are now matched against an allowed list, and files of other types have their extension changed automatically. Forms that accept unusual file types may need those types added, and custom code using wpcf7_unship_uploaded_file() may need changes. Test every form after updating. BLACKBX records each update, dated, in the client’s security logbook so any change can be traced.

Is this your site?

Does the Contact Form 7 file upload flaw apply to your website?

Tell us your site and we’ll tell you whether it runs an affected version of Contact Form 7 and has a form that accepts uploads. If it does, we can update it, check it and record the work in your security logbook.

Ask us if this applies to you Get these alerts by email

Or call +61 2 9043 1246. Monthly plans, no minimum term.