Skip to content
Critical Unauthenticated File Upload Vulnerabilities Disclosed in WidzialniCMS and WordPress Plugin

Critical Unauthenticated File Upload Vulnerabilities Disclosed in WidzialniCMS and WordPress Plugin

First seen 9 Nov 2026, 17:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 17:11 UTC
  • •CVE-2026-114432 in Contact Form 7 allows unauthenticated RCE via arbitrary file uploads.
  • •WidzialniCMS has two critical vulnerabilities (CVE-2026-110468, CVE-2026-110469) also allowing unauthenticated RCE.
  • •All vulnerabilities are rated critical with CVSS scores of 9.8 and 10.0, necessitating immediate patching.

Two critical vulnerabilities have been disclosed affecting WidzialniCMS and the WordPress plugin Contact Form 7. CVE-2026-114432 in Contact Form 7 allows unauthenticated file uploads leading to remote code execution (RCE) for versions prior to 6.2.4. CVE-2026-110468 and CVE-2026-110469 in WidzialniCMS enable unauthenticated attackers to upload arbitrary files, also resulting in RCE. The vulnerabilities were reported by CERT Polska and have been patched in the latest WidzialniCMS version 2.5. The CVSS scores for these vulnerabilities are 9.8 and 10.0, respectively, indicating a critical severity level. Organizations using these systems are urged to apply updates immediately to mitigate potential exploitation risks. As of now, there is no confirmed exploitation in the wild for these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7h ago How this analysis works

Timeline

2026-11-08
CVE-2026-114432 published
Contact Form 7 vulnerability disclosed, allowing unauthenticated file uploads leading to RCE.
Rescana
2026-11-09
CVE-2026-110468 and CVE-2026-110469 published
WidzialniCMS vulnerabilities disclosed, enabling unauthenticated file uploads and RCE.
Cert.Pl

More articles in this cluster (6)

Following this threat?

Track Debian and CVE-2026-110468 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3

Common questions

Which versions of Contact Form 7 are affected?
Versions prior to 6.2.4 of Contact Form 7 are affected by CVE-2026-114432.
What should organizations using WidzialniCMS do?
Organizations should update to version 2.5 of WidzialniCMS to mitigate the vulnerabilities.
Is there any evidence of exploitation for these vulnerabilities?
As of now, there is no confirmed exploitation in the wild for these vulnerabilities.