UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-6449

Contact Form 7: Unrestricted Upload of File with Dangerous Type

Severity
High 7.2
Published
30 Nov 2023
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
5.8.4
Also known as
WPV-3f3e7cdb5d81
Sources
NVD, WPVulnerability

Description

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files on the affected…

Affected software

SoftwareAffected versions
Contact Form 7Servers and applications · cpe:a:rocklobster:contact_form_7
  • Every version before 5.8.4
Contact Form 7WordPress plugins · wp-plugin:contact-form-7
  • Every version before 5.8.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-6449
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-6449
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-7/contact-form-7-583-authenticated-editor-arbitrary-file-upload