The Contact Form 7 WordPress plugin, prior to version 6.2.4, fails to validate the type or extension of files uploaded via a form file field. Coupled with a flaw in the temporary-file cleanup routine, this allows an unauthenticated user to place an arbitrary file on the server’s filesystem. On a default Debian or Ubuntu Apache setup that exposes directory listings and treats .phar files as executable PHP, the attacker can upload a malicious .phar or PHP file and trigger its execution, resulting in full remote code execution. Where directory listings are disabled or .htaccess overrides are enabled, the vulnerability still permits an unauthenticated user to write any file to the uploads directory; if the web server serves the file as active content such as HTML or SVG, the attacker can inject scripts or other dangerous content, potentially allowing defacement or data exfiltration.

WordPress sites using the Contact Form 7 plugin version 6.2 through 6.2.3 are affected. The issue arises in any deployment of this plugin that allows file uploads through its contact form fields, regardless of theme or other plugins. The impact is most severe on installations that run default Apache configurations on Debian or Ubuntu, but also applies to nginx or Apache setups with .htaccess overrides where arbitrary files can still be served.

The exploit is straightforward: an attacker can submit a form that includes a file with a chosen filename and MIME type. Because the plugin does not enforce file type restrictions, a malicious payload can be uploaded. Once stored, the file remains on disk due to the missing cleanup, providing a persistence mechanism. The vulnerability can lead to remote code execution if the uploaded file is executable by the web server, or to the delivery of active content that can compromise the site’s users. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog; however, the potential for RCE combined with the lack of any mitigation policy makes the risk high. Attackers need only send a crafted HTTP request to the contact form endpoint, which is generally accessible on a public‑facing site.