Contact Form 7 vulnerabilities
We track 1 vulnerability in Contact Form 7 products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on November 8, 2026.
1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score
Latest Contact Form 7 vulnerabilities
- 9.8 Critical severity
Contact Form 7: Unrestricted Upload of File with Dangerous Type
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary