WordPress plugin security: Contact Form 7 6.2.4 and 5 more

Contact Form 7, used on more than 10 million WordPress sites, fixed a hole in versions 6.2 to 6.2.3 that lets a visitor upload files without logging in. Patchstack lists it as likely to be used in mass attacks. Five more plugins released fixes between 31 October and 1 November. None was reported as attacked when we checked. Update Contact Form 7 today.

Which Contact Form 7 versions are affected?

Only 6.2, 6.2.1, 6.2.2 and 6.2.3. Patchstack says 6.1.7 and older are not affected by this hole. The fix is in 6.2.4, and the current version on WordPress.org is 6.2.4.1. If your site shows any 6.2 version below 6.2.4, update now.

Which other plugins should I update?

The holes that need a subscriber login matter most on sites that let anyone register, such as shops and membership sites.

What to do

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find Contact Form 7 first. If the version is 6.2 to 6.2.3, take a backup and update it now.
3. Check the table above and update any of those plugins, one at a time.
4. After each update, send a test message through your contact form and check it arrives.
5. If you cannot update Contact Form 7 today, ask your web developer or host for help the same day.

How SyncTech can help

If an outside developer looks after your website, forward this post to them now. Plugin updates with a backup first are part of our website maintenance service in Malaysia, and the Synctech help centre lists how to reach us if your contact form stops sending.

Source and credit

We are sharing this news from Patchstack and the plugin makers. This summary is written by Synctech in our own words.

• Contact Form 7 6.2 to 6.2.3 unauthenticated arbitrary file upload, Patchstack, 31 October 2026: https://patchstack.com/database/wordpress/plugin/contact-form-7/vulnerability/contact-form-7-6-2-3-unauthenticated-arbitrary-file-upload
• Contact Form 7 changelog, WordPress.org: https://wordpress.org/plugins/contact-form-7/#developers
• Ninja Forms 3.15.5 and older arbitrary shortcode execution, Patchstack, 31 October 2026: https://patchstack.com/database/wordpress/plugin/ninja-forms/vulnerability/wordpress-ninja-forms-contact-form-builder-with-calculators-quizzes-signatures-ai-form-builder-plugin-3-15-5-authenticated-subscriber-arbitrary-shortcode-execution-vulnerability
• Ninja Forms changelog, WordPress.org: https://wordpress.org/plugins/ninja-forms/#developers
• MapPress before 2.97.15 email address disclosure, Patchstack, 1 November 2026: https://patchstack.com/database/wordpress/plugin/mappress-google-maps-for-wordpress/vulnerability/wordpress-mappress-plugin-2-97-15-unauthenticated-email-address-disclosure-vulnerability
• MapPress changelog, WordPress.org: https://wordpress.org/plugins/mappress-google-maps-for-wordpress/#developers
• Media Library Assistant before 3.44 stored cross-site scripting, Patchstack, 1 November 2026: https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-44-contributor-stored-xss-vulnerability
• Media Library Assistant changelog, WordPress.org: https://wordpress.org/plugins/media-library-assistant/#developers
• Kali Forms before 2.4.30 email sending and sender spoofing, Patchstack, 1 November 2026: https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-kali-forms-contact-form-drag-and-drop-builder-plugin-2-4-30-subscriber-email-sending-and-sender-spoofing-vulnerability
• Kali Forms changelog, WordPress.org: https://wordpress.org/plugins/kali-forms/#developers
• PublishPress Authors 4.17.0 and older stored cross-site scripting, Patchstack, 31 October 2026: https://patchstack.com/database/wordpress/plugin/publishpress-authors/vulnerability/wordpress-co-authors-multiple-authors-and-guest-authors-in-an-author-box-with-publishpress-authors-plugin-4-17-0-authenticated-subscriber-stored-cross-site-scripting-vulnerability
• PublishPress Authors, WordPress.org: https://wordpress.org/plugins/publishpress-authors/#developers Retrieved 2 November 2026. WordPress, Contact Form 7 and the plugin names above are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.