PT-2026-23495 · WordPress · Drag/Drop Multiple File Upload – Contact Form 7

Thomas Sanzey · Publicado 2026-03-05 · Atualizado 2026-03-08 · CVE-2026-3459

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress versions through 1.3.7.3

Description The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress has a flaw that allows for arbitrary file uploads. This is due to inadequate file type validation within the dnd upload cf7 upload function. An unauthenticated attacker could potentially upload arbitrary files to the server, which could lead to remote code execution. This is exploitable when a form includes a multiple file upload field and allows all file types ('*').

Recommendations Update Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress to a version later than 1.3.7.3.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-3459

Produtos afetados

Drag/Drop Multiple File Upload – Contact Form 7

Referências · 8

• https://wordfence.com/threat-intel/vulnerabilities/id/3205670c-5c3c-48c3-a34a-6f9c25668258?source=cve · Nota
• https://twitter.com/TheHackerWire/status/2030614506507002190 · Publicação no Twitter
• https://t.me/CVEtracker/46481 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3475121/drag-and-drop-multiple-file-upload-contact-form-7 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3459 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.5/inc/dnd-upload-cf7.php#L1146 · Nota
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.5/inc/dnd-upload-cf7.php#L886 · Nota
• https://twitter.com/CVEnew/status/2029654713986146528 · Publicação no Twitter