PT-2026-23495 · WordPress · Drag/Drop Multiple File Upload – Contact Form 7

Thomas Sanzey · Published 2026-03-05 · Updated 2026-03-08 · CVE-2026-3459

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress versions through 1.3.7.3

Description The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress has a flaw that allows for arbitrary file uploads. This is due to inadequate file type validation within the dnd upload cf7 upload function. An unauthenticated attacker could potentially upload arbitrary files to the server, which could lead to remote code execution. This is exploitable when a form includes a multiple file upload field and allows all file types ('*').

Recommendations Update Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress to a version later than 1.3.7.3.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-3459

Affected Products

Drag/Drop Multiple File Upload – Contact Form 7

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3459 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3205670c-5c3c-48c3-a34a-6f9c25668258?source=cve · Note
• https://twitter.com/TheHackerWire/status/2030614506507002190 · Twitter Post
• https://t.me/CVEtracker/46481 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3475121/drag-and-drop-multiple-file-upload-contact-form-7 · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.5/inc/dnd-upload-cf7.php#L1146 · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.5/inc/dnd-upload-cf7.php#L886 · Note
• https://twitter.com/CVEnew/status/2029654713986146528 · Twitter Post