JPKCom DB
View on GitHub

JPKCom CF7 Upload Path — Guide & Tips

Switch the Contact Form 7 upload path to a safe directory with JPKCom CF7 Upload Path — installation, requirements and configuration.

JPKCom CF7 Upload Path changes the default Contact Form 7 upload path to a safe value. It does so by setting the CF7 constant WPCF7_UPLOADS_TMP_DIR.

Guide

Requirements

  • WordPress 6.9 or newer (tested up to WordPress 7.0)
  • PHP 8.3 or newer
  • Contact Form 7 must be installed and active (Requires Plugins: contact-form-7)
  • Multisite is supported (the plugin is network-enabled)

Installation

  1. In your admin panel, go to Plugins → Add New and click Upload Plugin.
  2. Choose the plugin's ZIP file and click Install Now.
  3. Make sure the Contact Form 7 plugin is active.
  4. Click Activate.

Configuration

The plugin defines the upload path via the Contact Form 7 constant:

<?php
define( 'WPCF7_UPLOADS_TMP_DIR', 'your-custom-tmp-dir' );

For background on file uploading and attachments in CF7, see the official Contact Form 7 documentation.

Tips & Tricks

  • There is no settings page: The plugin works solely through the constant — once active, the configured upload path takes effect.
  • Mind the order: Contact Form 7 must be active for the plugin to take meaningful effect (hence Requires Plugins: contact-form-7).
  • Reproducible updates: Since version 1.0.3 the plugin uses secure self-hosted updates via GitHub with SHA256 checksums, runs with declare(strict_types=1) and guards the constant definition.

Further reading