Contact Form 7 had a file-upload flaw. Here's what site owners should do.
Short answer: Contact Form 7 versions 6.2 to 6.2.3 had a flaw that could let anyone upload files through a form's file-upload field. It was fixed in 6.2.4 on 29 October 2026, and the current release is 6.2.4.1. Update now. After the update, Word, Excel and zip attachments arrive renamed, for example CV.docx becomes CV.docx_.txt. Your form isn't broken, and the files still open.
A file-upload flaw in a plugin on millions of sites.
Contact Form 7 is one of the most used WordPress plugins, with more than 10 million active installs according to WordPress.org. On 29 October 2026 its developer released version 6.2.4 to fix a weakness reported through WPScan. Here is what is known:
- Affected versions: 6.2, 6.2.1, 6.2.2 and 6.2.3 only. Older versions are not affected by this flaw.
- Fixed in: 6.2.4 (29 October 2026). The current release is 6.2.4.1.
- What it allows: someone without a login could upload a file of their choosing through a form's file-upload field. Patchstack rates it 8.1 out of 10 (High), according to WPDeeply.
- Who is most at risk: sites with a Contact Form 7 form that has a file-upload field, on a server that lists the contents of folders publicly (called directory listing). That is the vendor's own description.
- Attacks: none reported as of 2 November 2026.
Benin's national computer emergency team, bjCSIRT, published the same versions and fix.
Why CV.docx now arrives as CV.docx_.txt.
This is the part owners notice first. If your quote, job-application or booking form takes attachments, the update changes how some of them arrive.
Arrive as before
- Images
- Audio and video files
- PDF files
- Plain text (.txt) files
These are on the plugin's new safe list, according to the vendor note.
Arrive renamed
- Word files (.docx), for example CV.docx becomes CV.docx_.txt
- Excel files (.xlsx)
- Zip files (.zip)
- CSV files (.csv) and other types not on the safe list
The file inside isn't changed. Save it, delete the _.txt ending from the name, and it opens normally. C-TechLab checked this in the plugin's code.
Want Word or Excel files to arrive with their normal names again? A developer can add file types back to the safe list with the plugin's wpcf7_file_extension_safelist filter. Only add the types you really need, because the safe list is part of the fix. If you'd rather not touch code, ask customers to send PDFs, or ask us to set it up.
Four steps for site owners.
If a developer, agency or host looks after your site, send them this list and ask them to confirm the version when they're done.
Check your version
Log in to WordPress and open Plugins. Find Contact Form 7. If it shows 6.2 to 6.2.3, you need to update. 6.2.4 or 6.2.4.1 already has the fix.
Back up, then update
Take a backup first. The update needs WordPress 7.1 or higher, and WPDeeply says PHP 8.3 or higher. If your site is older, remove file-upload fields from your forms until you can update.
Send a test enquiry
Fill in your own form with a test attachment and check the email arrives. If a Word file arrives as .txt, that's the new safe list, not a broken form.
Close the open folder
Ask your host to turn off directory listing for wp-content/uploads, and to check recent uploads for files that shouldn't be there.
A security plugin is not a substitute for updating. Updating WordPress itself doesn't update your plugins, so check Plugins as well as Dashboard > Updates.
What nobody has said yet.
- Attacks: none reported as of 2 November 2026. The flaw wasn't on CISA's Known Exploited Vulnerabilities list when we checked. That means no reports so far, not that every site is safe.
- CVE number: none assigned yet, as of 2 November 2026.
- How many sites are affected: nobody has published a count. Only sites on 6.2 to 6.2.3 with a file-upload field are in scope.
- Whether your site updated by itself: only a look at your own Plugins page can tell.
We'll update this page if the developer, CISA or security companies publish more.
Get help now if any of these are true.
- You can't log in to WordPress, or don't know who can.
- Your site can't run WordPress 7.1 or PHP 8.3 yet, so the update won't install.
- Your form stopped sending enquiries after the update.
- You find files in your uploads folder you didn't put there.
We look after small business websites in the US, UK, Canada and Australia, including plugin updates and form testing. Your first fix is free. Start a chat and tell us your website address.
Is my Contact Form 7 form safe?
Check your version. The flaw is in Contact Form 7 versions 6.2 to 6.2.3 and is fixed in 6.2.4 (the current release is 6.2.4.1). The vendor says sites most at risk have a form with a file-upload field on a server that lists folder contents publicly. As of 2 November 2026, no attacks have been reported. Update now either way.
Why do Word and Excel attachments now arrive as .txt files?
It's a deliberate change in Contact Form 7 6.2.4. Files whose type isn't on the plugin's new safe list (images, audio, video, PDF and plain text) get a new ending, so CV.docx arrives as CV.docx_.txt. The file isn't damaged: save it, remove the _.txt ending, and it opens normally. A developer can add file types back with a setting in the plugin's code.
Can I update if my site runs an older WordPress or PHP?
Not to the current release. Contact Form 7 6.2.4 needs WordPress 7.1 or higher, and WPDeeply says the current branch needs PHP 8.3 or higher. If your site can't meet that yet, remove file-upload fields from your forms until you can update, and plan the WordPress and PHP upgrade.
Has this flaw been used in attacks?
No attacks have been reported as of 2 November 2026, and it wasn't on CISA's Known Exploited Vulnerabilities list when we checked. That can change, so update rather than wait.
Is there a CVE number?
Not yet, as of 2 November 2026. Patchstack rates the flaw 8.1 out of 10 (High), according to WPDeeply. There's also no public count of affected sites.
Does this affect Wix, Squarespace or Shopify forms?
No. Contact Form 7 is a WordPress plugin. Forms built into Wix, Squarespace, Shopify or Webflow don't use it.
Related pages.
Sources for this page
- Contact Form 7: version 6.2.4 release note (29 October 2026)
- WPDeeply: Contact Form 7 6.2.3 unauthenticated arbitrary file upload (1 November 2026)
- bjCSIRT (Benin): arbitrary file upload in the Contact Form 7 plugin (in French)
- C-TechLab: Contact Form 7 6.2.4 file upload changes (in Japanese)
- CISA Known Exploited Vulnerabilities catalog (checked 2 November 2026)
- WordPress.org: Contact Form 7 plugin page (10+ million active installs, checked 2 November 2026)