PT-2026-33468 · WordPress · Drag/Drop Multiple File Upload

Leonid Semenenko + 1 · Published 2026-04-17 · Updated 2026-05-27 · CVE-2026-5718

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 versions prior to 1.3.9.7

Description Insufficient file type validation occurs when custom blacklist types are configured, as the system replaces the default dangerous extension denylist instead of merging with it. Additionally, the wpcf7 antiscript file name() function can be bypassed using filenames containing non-ASCII characters. This allows unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, potentially leading to remote code execution.

Recommendations Update to a version later than 1.3.9.6.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-5718

Affected Products

Drag/Drop Multiple File Upload

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-5718 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/38f95d40-a6d4-429c-9872-9d2531e942eb?source=cve · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.6/inc/dnd-upload-cf7.php#L970 · Note
• https://t.me/cveNotify/164773 · Telegram Post
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.6/inc/dnd-upload-cf7.php#L62 · Note
• https://twitter.com/ctiwatchcloud/status/2047163560745222601 · Twitter Post
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.6/inc/dnd-upload-cf7.php#L883 · Note
• https://plugins.trac.wordpress.org/changeset/3548901 · Note
• https://twitter.com/CVEnew/status/2045889722463994137 · Twitter Post
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.6/inc/dnd-upload-cf7.php#L987 · Note
• https://twitter.com/VulmonFeeds/status/2045227307313275046 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3508522/drag-and-drop-multiple-file-upload-contact-form-7 · Note