It would be good to clarify that this only affects forms that use file upload fields. On the other hand, Contact Form 7 does not store files in the directory, but deletes them immediately after sending. So, in practice it’s not possible for a script to be executed because it’s sent and deleted immediately afterwards.