Critical Vulnerabilities in WidzialniCMS and Contact Form 7 Allow Remote Code Execution
Unauthenticated file upload vulnerabilities in WidzialniCMS and Contact Form 7 may lead to remote code execution. No confirmed exploitation reported.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
Unauthenticated file upload vulnerabilities in WidzialniCMS and Contact Form 7.
Who is affected
WidzialniCMS, Contact Form 7 versions prior to 6.2.4.
Exploited
No exploitation reported.
Two critical vulnerabilities, CVE-2026-110468 and CVE-2026-110469, have been identified in WidzialniCMS. These vulnerabilities allow unauthenticated file uploads, potentially leading to remote code execution. CERT Polska reported these issues, and they have been addressed in version 2.5 of WidzialniCMS.
Additionally, CVE-2026-114432 affects Contact Form 7 versions prior to 6.2.4, also permitting unauthenticated file uploads that could result in remote code execution.
The CVSS scores for these vulnerabilities are notably high, with CVE-2026-110468 scoring 9.8 and CVE-2026-110469 scoring 10.0, indicating their critical nature.
Currently, there is no confirmed exploitation of these vulnerabilities in the wild.
