Contact Form 7 version 6.2.4 is now available. This is a minor update release that includes several security fixes and enhancements. While the vulnerability is seen only in Contact Form 7 6.2 to 6.2.3, since the security enhancements apply to all versions of the plugin, we recommend upgrading to 6.2.4 for all users.
Outline of the issue
The issue is an unauthenticated arbitrary file upload. Attackers can leverage multiple flaws in Contact Form 7 6.2 to 6.2.3, in combination, to upload files that should normally be blocked by validation logic and keep files that should normally be removed immediately after submission.
Theoretically, all forms that have file uploading fields and are hosted on an HTTP server configured to list directory contents publicly can be a target.
This issue was detected by Shinya Murakami and Jakub Herman, and reported via WPScan.
Side effects
To enhance security, we needed to introduce changes that could affect certain use cases.
wpcf7_antiscript_file_name(), which sanitizes a file name that can be recognized as an executable script file, now uses a safelist of file extensions in place of the previous unsafelist. If a file with an extension that is not included in the safelist is uploaded, wpcf7_antiscript_file_name() automatically converts the extension part into a safe alternative.
By default, the safelist includes the following file extensions:
["3gp","3gpp","3g2","3gp2","aac","flac","mid","midi","mp3","m4a","m4b","ogg","oga","wav","x-wav","mka","wax","wma","ra","ram","avi","divx","mp4","m4v","mpeg","mpg","mpe","ogv","mov","qt","webm","flv","mkv","asf","asx","wm","wmv","wmx","avif","bmp","gif","heic","heics","heif","heifs","jpg","jpeg","jpe","png","tiff","tif","webp","ico","pdf","txt"]
You can customize this list using the wpcf7_file_extension_safelist filter hook, like the following:
add_filter( 'wpcf7_file_extension_safelist', function ( $safelist ) {
return array_merge( $safelist, ['zip'] ); // Adding .zip
} );
Another change was made to wpcf7_unship_uploaded_file(); its second $options argument is now mandatory, and a third $uploaded_files argument has been added. Although this function is not for daily use, and most users don’t even know it, if by any chance you call wpcf7_unship_uploaded_file() in your code, don’t forget to change the arguments.
Major changes
- Functions-PHP: Upgraded to 1.1.0.
- FormDataTree-PHP: Upgraded to 2.0.9.
- SWV-PHP: Upgraded to 2.0.8.
- Introduces the
wpcf7_file_extension_safelist()function and thewpcf7_file_extension_safelistfilter hook. - Improves
wpcf7_antiscript_file_name()with file extension safelist. - Applies
wp_scrub_utf8()to a target text before a regular expression pattern with theu(UTF-8) modifier is applied to it. - Improves
wpcf7_unship_uploaded_file()with the new third parameter ($uploaded_files) that is passed as a reference.
You can browse the complete list of changes on GitHub.
Requires: WordPress 7.1 or higher
Tested up to: WordPress 7.1.4