Contact Form 7 6.2-6.2.3 – Unauthenticated Arbitrary File Upload

Contact Form 7 versions 6.2 through 6.2.3 contain an unauthenticated arbitrary file upload vulnerability. The issue affects the plugin’s upload handling and can allow files that should be rejected to remain on disk. Contact Form 7 6.2.4 fixes the security issue; 6.2.4.1 is the current WordPress.org release and includes a separate regression fix.

Vulnerability summary

• Product: Contact Form 7
• Affected versions: 6.2 through 6.2.3
• Fixed version: 6.2.4 or later
• Current release at publication: 6.2.4.1
• Attack class: Unauthenticated arbitrary file upload
• Required privilege: None
• CVSS: 8.1 according to Patchstack
• CVE: No CVE has been assigned as of publication
• Exposure: Forms with file-upload fields; public directory listing materially increases practical risk

How the flaw works

The vendor says an attacker can combine multiple flaws in Contact Form 7 6.2-6.2.3 to upload a file that validation should block and keep a file that should have been removed after form processing. Patchstack reports that files can reach a temporary directory under wp-content/uploads/wpcf7_uploads/ before validation and that rejected files were not reliably deleted.

Exploitation uses the public Contact Form 7 feedback submission route, so authentication is not required. The affected site must expose a form with a file-upload field. The randomly generated temporary directory raises attack complexity, but a server configured to list directory contents can reveal uploaded files and make exploitation substantially easier. This advisory does not by itself establish that arbitrary PHP execution is possible on every host; web-server execution rules and other configuration details affect the final impact.

What changed in 6.2.4

Contact Form 7 6.2.4 replaces the previous extension blocklist with a safelist in wpcf7_antiscript_file_name(), adds the wpcf7_file_extension_safelist filter, improves UTF-8 handling, and changes wpcf7_unship_uploaded_file() so it can track uploaded files for cleanup. Sites should install 6.2.4.1 where compatible rather than stopping at the first fixed build.

Immediate remediation

1. Update Contact Form 7 to 6.2.4.1 or the newest available release. Version 6.2.4 is the first security-fixed release.
2. Confirm the updated plugin’s requirements before deployment. The current branch requires WordPress 7.1 or later and PHP 8.3 or later; stage the update when older production environments are involved.
3. Disable public directory listing for wp-content/uploads/ and its subdirectories.
4. If an immediate update is impossible, temporarily remove file-upload fields or disable affected forms until the plugin and platform can be upgraded.
5. Review recent files and access logs for unexpected upload activity, then preserve suspicious files for investigation before removing them.

Verify the installed version

wp plugin get contact-form-7 --field=version
wp plugin update contact-form-7
wp plugin get contact-form-7 --fields=name,status,version,update

A safe result is version 6.2.4 or later. Because 6.2.4.1 is available, use that release or a newer vendor-supported build when the site’s WordPress and PHP versions satisfy the requirements.

Check for indicators of compromise

Inspect the Contact Form 7 temporary-upload area for recently created or unexpected files. The following read-only commands list files and highlight extensions that deserve investigation. Adjust the WordPress path for your environment.

find wp-content/uploads/wpcf7_uploads -type f -printf '%TY-%Tm-%Td %TH:%TM %p\n' 2>/dev/null | sort -r
find wp-content/uploads/wpcf7_uploads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.pht' -o -iname '*.phar' -o -name '.htaccess' \) -print 2>/dev/null

Also search web-server and WAF logs for unusual bursts of unauthenticated POST requests to Contact Form 7 feedback endpoints, especially requests followed by direct access to paths below /wp-content/uploads/wpcf7_uploads/. Investigate unfamiliar administrator accounts, recently modified plugins or themes, unexpected scheduled tasks, and executable files elsewhere under uploads. A matching request or file is an investigation lead, not proof of compromise by itself.

Temporary hardening

Temporary mitigation only: On Apache, disable directory indexes and prevent script execution in the uploads directory. Test server configuration changes before production rollout.

Options -Indexes

<FilesMatch "\.(php|phtml|pht|phar|phps)$">
    Require all denied
</FilesMatch>

This hardening reduces exposure but does not repair Contact Form 7’s upload logic. Updating the plugin remains the required fix.

Sources

• Contact Form 7 6.2.4 vendor security announcement
• Patchstack vulnerability record
• Contact Form 7 on WordPress.org