CVE-2026-114432

The Contact Form 7 WordPress plugin versions prior to 6.2.4 is vulnerable to an unauthenticated arbitrary file upload flaw. The issue stems from a failure to validate file types or extensions in form file fields, combined with a flaw in temporary-file cleanup that leaves files on the disk. Depend...