From Dev.to
Contact Form 7 File Upload Flaw (CVE-2026-114432): Which WordPress Sites Are Exposed and What to Do
Contact Form 7 versions 6.2 to 6.2.3 have an unauthenticated file upload flaw, CVE-2026-114432, rated CVSS 9.8. On some Apache setups the uploaded file can be run as code; on others it can still be se...