Skip to main content
株式会社オブライト
Network & Infrastructure2026-11-0910 min read

Contact Form 7 CVE-2026-114432 + 3 more

Vulnerability Digest Nov 9, 2026

Contact Form 7 (10M+ sites) 6.2-6.2.3: unauthenticated file upload. Update to 6.2.4 before the Nov 19 PoC. NEC WinShare fix module, Craft CMS 5.11.2, Kyverno.

脆弱性情報まとめセキュリティITリスク対策CVE脆弱性WordPressWindows

The top priority is CVE-2026-114432 in Contact Form 7, the WordPress form plugin. Versions 6.2 through 6.2.3 allow an unauthenticated arbitrary file upload, rated CVSS 3.1 9.8 (Critical), fixed in 6.2.4. The plugin has over 10 million active installs. No exploitation has been reported, but WPScan plans to publish a PoC (proof of concept) on November 19. Today, check your Contact Form 7 version and update to 6.2.4 or later. If you use NEC WebSAM WinShare, apply the fix module NEC released. Updates are also out for Craft CMS and Kyverno.

This digest is based on WPScan, the CVE record, the official Contact Form 7 release notes, NEC security information and GitHub security advisories, all checked on November 9 (JST). Anything not stated is treated as not disclosed. No exploitation has been reported for any of today's four products, and none has been added to CISA's KEV catalog (the list of vulnerabilities known to be exploited). Because the PoC date for CF7 is set, treat November 19 as the practical deadline.

Today's Vulnerabilities

ProductCVESeverity (CVSS)ExploitationFix (patched version)
WordPress plugin Contact Form 7CVE-2026-1144329.8 Critical (CVSS 3.1)Not exploited. PoC due Nov 196.2.4 or later (current latest is 6.2.4.1)
NEC WebSAM WinShareCVE-2026-113363 / CVE-2026-113364 / CVE-2026-1133629.3 / 9.3 / 8.5 (all CVSS 4.0)No exploitation reportedApply the fix module from NEC (no version number published)
Craft CMSCVE-2026-124427 / CVE-2026-1244309.8 (3.1), 9.3 (4.0) / 8.8 (3.1), 8.7 (4.0)No exploitation reported5.11.2
KyvernoCVE-2026-1244409.9 (CVSS 3.1) / 9.4 (CVSS 4.0)No exploitation reported1.19.2 (only 1.19.1 is affected)

1. Contact Form 7 CVE-2026-114432: unauthenticated arbitrary file upload (CVSS 9.8)

According to WPScan (titled "Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename") and the CVE record, the file upload field in Contact Form 7 does not validate the type or extension of uploaded files. A flaw in the cleanup of temporary files also leaves them on disk. No login is required and it can be exploited remotely. It is rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), weakness type CWE-434 (unrestricted upload of file with dangerous type). CISA-ADP's SSVC lists exploitation as none, automatable as yes, and technical impact as total. It was reported by Shinya Murakami.

In plain terms, the "attach a file" field on your contact form can become a way for strangers to put files on your server. What those files can do depends on the server setup.

- On a standard Debian / Ubuntu Apache configuration (directory listing enabled and .phar mapped to the PHP handler), the stored file can be found and executed, which can lead to remote code execution (RCE)
- On nginx, or on Apache with .htaccess overrides enabled, it stays an arbitrary file write into the uploads directory. Such files can still be served as HTML or SVG from the site's own origin, which can be abused for phishing or XSS

Affected versions are 6.2 through 6.2.3 (the CVE record says 6.2 up to but not including 6.2.4). 6.1.x and earlier are not affected. The fix is 6.2.4, released on October 29, 2026. The current latest on WordPress.org is 6.2.4.1, released the same day, which updates the bundled library FormDataTree-PHP to 2.0.10 after 6.2.4. Anything at 6.2.4 or later is fixed. WPScan listed it on November 5 and the CVE was published on November 8. The official site reports over 10 million active installs.

One caution when updating. According to the official release notes, 6.2.4 changes the upload filename check from a blocklist to a safelist. Forms that accept files with unusual extensions may stop accepting them. After updating, send a test submission through a form with an attachment.

First, check the version. Look at the version shown in the admin Plugins list, or run the commands below on the server. If WP-CLI is not available, ask your web agency or maintainer.

# Check the version and whether an update is available (WP-CLI)
wp plugin list --name=contact-form-7 --fields=name,version,update
wp plugin get contact-form-7 --field=version

# Without WP-CLI: read the Version line of the plugin file
grep "Version:" wp-content/plugins/contact-form-7/wp-contact-form-7.php

# Update to 6.2.4 or later (take a backup first on production)
wp plugin update contact-form-7

If you cannot update right away, these are general precautions (not an official vendor workaround): suspend forms that have a file upload field (remove the file tag), deny PHP execution under the uploads directory, disable Apache directory listing (Options -Indexes), remove the .phar PHP handler mapping, or block with a WAF.

# Apache example: deny execution of PHP-type files under uploads (.htaccess)
<FilesMatch "\.(php|phar|phtml)$">
  Require all denied
</FilesMatch>

# nginx example (add to the server config)
location ~* /wp-content/uploads/.*\.(php|phar)$ { deny all; }

You can also look for traces of an attack as a general procedure. Check under uploads, especially Contact Form 7's temporary directory (by default wp-content/uploads/wpcf7_uploads), for unexpected files. Finding one does not prove a compromise, but if you see an unfamiliar .php or .phar, ask your maintainer to investigate.

# Find executable, HTML or SVG files created since October
find wp-content/uploads -type f \( -name "*.php" -o -name "*.phar" -o -name "*.phtml" -o -name "*.html" -o -name "*.svg" \) -newermt 2026-10-01

2. NEC WebSAM WinShare CVE-2026-113363 and others: crafted traffic can yield SYSTEM privileges (CVSS 4.0 9.3)

NEC security information NV26-006 (published November 9) lists three vulnerabilities in WebSAM WinShare, a remote control tool for Windows. Two need no authentication and can give an attacker SYSTEM privileges (the strongest on Windows) over the network.

- CVE-2026-113363 (CVSS 4.0: 9.3): flaw in handling of communication packets. A crafted packet can run arbitrary commands with SYSTEM privileges. Affects Ver 7.2.0 to 7.5.0, Ver 7.6.0 and Ver 7.7.0 to 7.7.2
- CVE-2026-113364 (CVSS 4.0: 9.3): buffer overflow in data reception. A crafted packet can run arbitrary code with SYSTEM privileges. Affects Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 to 7.7.2
- CVE-2026-113362 (CVSS 4.0: 8.5): improper access control on the program folder. An attacker logged in with ordinary user rights could gain SYSTEM privileges on the remotely controlled PC (a local flaw). Affects Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 to 7.7.1

The remedy is to apply the fix module distributed through the NEC support portal (there are modules for Ver 7.6 and Ver 7.7, and they can also be applied to 7.5.0 and earlier; downloading requires logging in to the portal). No fixed version number has been published, because the fix is delivered as a module. No exploitation has been reported. It was reported by Masahiro Kawada and by Ruslan Sayfiev and Denis Faiustov of Fujitsu Limited.

In plain terms, a PC running WinShare could be taken over just by sending it crafted data. If you do not know whether you use it, ask your IT contact or the vendor that installed it. If you do not use it, this item does not apply. Official: NEC NV26-006, CVE-2026-113363, CVE-2026-113364

3. Craft CMS CVE-2026-124427 / CVE-2026-124430: reading unpublished content, and command execution by a control panel user

According to GitHub security advisories, Craft CMS 5.x has two vulnerabilities, both fixed in 5.11.2. These are new CVEs, separate from CVE-2026-123488 covered in the November 7 digest.

- CVE-2026-124427 (CVSS 3.1: 9.8 / 4.0: 9.3): 5.0.0 up to but not including 5.11.2. An anonymous GraphQL client can follow the prev / next fields and read entries (title, slug, custom fields) from sections that are not publicly exposed, an authorization bypass. No authentication is needed
- CVE-2026-124430 (CVSS 3.1: 8.8 / 4.0: 8.7): 5.10.0 up to but not including 5.11.2. A non-admin control panel user can obtain a signed Twig template and pass it to the login redirect argument, where it is evaluated outside the sandbox. This can run OS commands with the PHP worker's privileges

No exploitation has been reported. In plain terms, the first lets outsiders read the content of entries you meant to keep private, and the second lets an ordinary user who can log in to the admin panel operate the server. If you use Craft CMS, ask your web agency to check the version and update to 5.11.2 or later. To check it yourself:

# Check the Craft CMS version (run in the project directory)
php craft --version
grep -A1 '"name": "craftcms/cms"' composer.lock

# Update (take a backup and test on staging first for production)
composer update craftcms/cms
php craft up

4. Kyverno CVE-2026-124440: namespace restriction bypass (CVSS 3.1 9.9)

Kyverno is a policy engine for Kubernetes. According to the GitHub security advisory, only 1.19.1 (1.19.1 up to but not including 1.19.2) is affected. The apiCall namespace restriction can be bypassed by adding an invalid percent escape to urlPath, letting a namespace tenant call APIs in other namespaces or at cluster scope with the admission-controller's ServiceAccount privileges. It is rated CVSS 3.1 9.9 and CVSS 4.0 9.4. The fix is 1.19.2, and no exploitation has been reported.

This mainly concerns multi-tenant clusters where namespaces are opened to multiple users or teams. Few small and mid-sized businesses fall into that group, and companies that do not run Kubernetes are not affected. If you do, check the version as follows.

# Check the Kyverno version
kubectl get deploy -n kyverno -o jsonpath='{..image}'
helm list -n kyverno

Checklist for non-IT staff: what to do today

- Ask your web agency or maintainer whether your site runs on WordPress. If so, check whether the contact form uses Contact Form 7
- If it does, check that the version is not 6.2 through 6.2.3, and if it is, ask for an update to 6.2.4 or later (current latest 6.2.4.1) today. The PoC is due on November 19
- After updating, send a test submission through a form that accepts attachments
- If the update will be delayed, ask for the file upload field to be removed temporarily
- Ask your IT contact whether NEC WebSAM WinShare (a remote control tool) is in use. If so, ask for NEC's fix module to be applied
- Ask your web agency whether your site is built on Craft CMS. If so, ask for an update to 5.11.2 or later
- If you do not use Kubernetes (Kyverno), note that it does not apply. If you do, ask the owner to confirm the version is not 1.19.1

Related articles

Sources

FAQ

We use Contact Form 7. Will we definitely be taken over?

No. Only 6.2 through 6.2.3 are affected; 6.1.x and earlier, and 6.2.4 and later, are not. Whether it leads to a takeover depends on the server setup. On a standard Debian / Ubuntu Apache configuration the stored file may be executed. On nginx and similar it stays an arbitrary file write, which can still be abused for phishing, so update if your version is affected. No exploitation has been confirmed so far.

After updating, file attachments on my form stopped working.

According to the official release notes, 6.2.4 changed the upload filename check to a safelist. If your form accepts files with unusual extensions, they may be rejected. After updating, send a test submission with an attachment to check that the extensions you need still work, and consult your web agency.

What is the fixed version number of NEC WebSAM WinShare?

None has been published. NEC delivers the fix as a module, with separate modules for Ver 7.6 and Ver 7.7 on the support portal (login required). They can also be applied to Ver 7.5.0 and earlier.

Is Craft CMS CVE-2026-124427 the same as CVE-2026-123488 from November 7?

No, they are different CVEs. November 7 covered an unauthenticated SQL injection (CVE-2026-123488, fixed in 4.18.9 and 5.11.2). Today covers reading entries outside the public scope (CVE-2026-124427) and command execution by a control panel user (CVE-2026-124430), both fixed in 5.11.2. Moving to 5.11.2 or later fixes both of today's.

Does Kyverno's CVSS 9.9 need immediate action?

If you run 1.19.1 in an environment where namespaces are opened to multiple users, update to 1.19.2 promptly. Companies that do not use Kubernetes or Kyverno are not affected. Judge by whether your own setup is affected, not just by the size of the score.

Related free tools (no sign-up, instant results)

Maintenance Risk CheckEight questions to rate your maintenance risk

Feel free to contact us

Contact Us