JPKCom DB
View on GitHub (opens in a new tab)

JPKCom CF7 Upload Path — Guide & Tips

Switch the Contact Form 7 upload path to a safe directory with JPKCom CF7 Upload Path — installation, requirements and configuration.

JPKCom CF7 Upload Path changes the default Contact Form 7 upload path to a safe value. It does so by setting the CF7 constant WPCF7_UPLOADS_TMP_DIR.

Guide

Requirements

  • WordPress 6.9 or newer (tested up to WordPress 7.1)
  • PHP 8.3 or newer
  • Contact Form 7 (opens in a new tab) must be installed and active (Requires Plugins: contact-form-7)
  • Multisite is supported (the plugin is network-enabled)

Installation

  1. In your admin panel, go to Plugins → Add New and click Upload Plugin.
  2. Choose the plugin's ZIP file and click Install Now.
  3. Make sure the Contact Form 7 plugin is active.
  4. Click Activate.

Configuration

The plugin defines the upload path via the Contact Form 7 constant:

<?php
define( 'WPCF7_UPLOADS_TMP_DIR', 'your-custom-tmp-dir' );

For background on file uploading and attachments in CF7, see the official Contact Form 7 documentation (opens in a new tab).

Tips & Tricks

  • There is no settings page: The plugin works solely through the constant — once active, the configured upload path takes effect.
  • Mind the order: Contact Form 7 must be active for the plugin to take meaningful effect (hence Requires Plugins: contact-form-7).
  • Reproducible updates: Since version 1.0.3 the plugin uses secure self-hosted updates via GitHub with SHA256 checksums, runs with declare(strict_types=1) and guards the constant definition. Since 1.0.9 it also carries the Update URI header: the wordpress.org update API then no longer returns updates for this plugin, so a plugin published there under the same slug cannot pose as an update. Since 1.0.10 Dashboard → Updates shows the JPKCom logo as the plugin icon. Since 1.0.11 (updater 1.5.0) the plugin is offered updates even while deactivated — provided another JPKCom plugin with updater 1.5.0 or later is active, on multisite network-wide or on the main site: one loaded updater serves all installed JPKCom plugins with the update row, icon and “View details”, and the SHA256 check applies just the same. The stored update list no longer contains JPKCom download URLs; they come back only while a JPKCom updater is loaded, so without one no unverified package can be installed. The check also verifies packages supplied by another plugin and recognises every GitHub address of a release file. A Git or other version-control checkout and a renamed folder (such as jpkcom-cf7-upload-path-main) are told about new releases but never updated through WordPress — the update would delete the checkout or the folder. A renamed folder is only told while the plugin in it is active; for deactivated plugins the updater only recognises the jpkcom-cf7-upload-path/ folder. The updater fetches update information only for accounts that may update plugins, in the update cron and in WP-CLI, never for anonymous visitors.

Further reading