CVE-2024-1069 is a High severity arbitrary file upload, scored 7.2, in the Contact Form Entries plugin for WordPress. Versions up to and including 1.3.2 are affected, and an administrator level account is needed. Update to a release after 1.3.2 and check the plugin changelog.
What's affected
The record lists Contact Form Entries up to and including 1.3.2. The cause is insufficient file validation in the view_page function. Exploiting it needs an authenticated user with administrator level capabilities or above.
The record gives no fixed version number. Its references include a plugin changeset (3028640), which suggests a code fix, but the Wordfence page body could not be read when I fetched it. Read the plugin changelog for the first release after 1.3.2.
How to check if you're exposed
In the WordPress admin, open Plugins, Installed Plugins and read the version shown under Contact Form Entries. From a shell with WP-CLI, list plugins and their versions.
wp plugin list --fields=name,status,version,update
Compare the version with the affected range above. If the plugin is not installed, you are not exposed through this CVE. The free in-browser dependency scan also covers dependencies in your own code, though WordPress plugins are tracked by the site, not a lockfile.
What to do now
- List sites running the plugin and note the version.
- Update to a release newer than 1.3.2 and confirm in the changelog that it names this fix.
- Audit administrator accounts. The flaw needs one, so remove stale accounts and require strong passwords and two factor sign in.
- Check the uploads directory and plugin folders for files you do not recognise.
- If you do not use the plugin, remove it.
Why it matters
The class is unrestricted upload of a dangerous file type, CWE-434. If a file with executable code lands in a web served folder, the server may run it, which the record notes could make remote code execution possible.
The administrator requirement lowers the practical risk, which is why the score is 7.2 and not higher. It does not remove it. Administrator accounts get phished and reused, and on shared or agency managed sites many people hold that role. The record's KEV flag is false.
Quick check
Does an attacker need to be logged in?
Yes. The record says administrator level capabilities or above are required.
Which version fixes it?
The record names none beyond saying versions up to 1.3.2 are affected. Use the first newer release and confirm in the changelog.
Sources
- Wordfence advisory and WordPress plugin changeset, from the record references (Wordfence advisory, page body could not be read when fetched)
- NVD record and references for CVE-2024-1069
Last reviewed: 19 October 2026.
