Your CV form can send successfully and still deliver a Word document that nobody can open. That’s the awkward part of the latest Contact Form 7 update. There’s also a security fix: version 6.2.4 closes an unauthenticated file upload flaw, and you should update straight to 6.2.4.1.
I’m Andrei, and I run a WordPress maintenance and security agency. My advice here has two parts: install the fix, then test what actually lands in your inbox. A green confirmation message isn’t enough.
What happened?
Contact Form 7 6.2.4 was released on 29 October 2026. According to the Contact Form 7 release post on contactform7.com, attackers could combine several flaws in versions 6.2 through 6.2.3 to upload files that validation should reject, then retain files that should disappear after submission. No login needed.
Shinya Murakami and Jakub Herman found the issue and reported it through WPScan. The vendor didn’t report attacks happening, so don’t read this as evidence that your own site has been breached.
Version 6.2.4.1 arrived the same day. Its changelog says only “FormDataTree-PHP: Upgraded to 2.0.10”, while the plugin’s GitHub issue tracker, issue #1908, connects it to an optional upload field failing validation when left empty in 6.2.4.
Skip that intermediate release. Install 6.2.4.1.
Does this affect your site?
The vulnerability exists only in Contact Form 7 6.2 to 6.2.3. The vendor describes the risk as theoretically affecting any form with a file upload field where the server also allows public directory listings. That listing lets someone locate a leftover file.
Think CV submissions, artwork uploads for printed packaging, or spreadsheet attachments on a wholesale quote request. A WooCommerce checkout without Contact Form 7 isn’t automatically affected just because it takes orders.
The vendor still recommends the security enhancements for all users, including those outside the affected versions. The current release requires WordPress 7.1 or higher and is tested up to 7.1.4. Check compatibility before updating an older installation; take a backup and use staging if your WordPress upgrade needs testing.
The 6.2 branch had a rough month, including critical errors after the earlier 6.2 update.
The attachment surprise: your files may arrive renamed
This deserves more attention than a quick “updated, done”. Contact Form 7 changed how wpcf7_antiscript_file_name() handles extensions. Instead of blocking a list of extensions, it now uses a safelist: extensions outside that list get converted to a safe alternative, such as .txt.
The default list covers audio, video and image formats, plus pdf and txt. It doesn’t include common office and archive formats:
- Word and OpenDocument files:
doc,docx,odt. - Spreadsheets and data:
xls,xlsx,ods,csv. - Archives and presentations:
zip,ppt.
A buyer uploads a spreadsheet containing product codes and quantities. Your quote form accepts it, sends the email, and shows its usual thank-you message. But sales gets an attachment with a changed extension, which won’t open as expected with a double-click.
Nothing looks broken from the customer’s side. That’s the trap.
If you genuinely need those formats, the new wpcf7_file_extension_safelist filter lets you add them. Put this in a child theme’s functions.php or a small code snippets plugin, trimming the example to your actual requirements:
add_filter( 'wpcf7_file_extension_safelist', function ( $safelist ) {
return array_merge(
$safelist,
[ 'doc', 'docx', 'xls', 'xlsx', 'odt', 'csv', 'zip' ]
);
} );Don’t paste the whole list just because it’s convenient. A CV form accepting PDF and Word documents doesn’t need ZIP archives. Keep the filetypes: option on each [file] tag narrow too; this filter doesn’t replace the form’s allowed-file settings.
My preference is PDF wherever it fits the job. For a quote spreadsheet you need editable data, fair enough. Add that format, then open the received attachement yourself.
Developer note: wpcf7_unship_uploaded_file() now requires a second $options argument and accepts a new third $uploaded_files argument, so check custom code calling it.
Check whether your uploads folder shows a file list
Open your site’s /wp-content/uploads/ address in a private browser window. An “Index of” page listing files or folders means directory listing is enabled there. A forbidden response or no listing is reassuring for that location, though it doesn’t prove every subfolder has the same configuration.
On Apache, Options -Indexes in the appropriate .htaccess configuration disables listing where the host permits it. On Nginx, the setting is autoindex off;, which is the default. Ask your host to check if server configuration isn’t your territory.
Also inspect wp-content/uploads/wpcf7_uploads through your hosting file manager or SFTP. Contact Form 7 uses it for temporary uploads and deletes uploaded files after sending. Unexpected files, especially .php or .phtml, deserve investigation as a possible compromise, not a casual delete-and-forget.
If you find something suspicious, preserve the details and get help with hacked site cleaning. Updating won’t remove an existing compromise.
Do this today
- Back up, check compatibility, update, then confirm
6.2.4.1on thePlugins > Installed Pluginsscreen. - Test every upload form with a permitted file and, for optional fields, with no file selected.
- Open each received attachment. Check its extension, not just whether the email arrived.
- Disable directory listing and inspect the temporary upload folder for unexpected files.
If nobody owns these checks, make them part of your WordPress maintenance routine. Upload testing belongs alongside checkout testing, not underneath “we’ll get to it”.
Finish with the inbox, not the update screen
Our earlier article on Forminator’s critical file-upload flaw covers a different plugin; don’t confuse the two issues.
For this one, pick your busiest CV or quote form today. Submit a real sample, leave an optional upload empty on a second submission, and open what arrives. That’s the check your update screen can’t do for you.