PT-2026-34855 · WordPress · Drag/Drop File Upload For Contact Form 7

Thomas Sanzey · Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-5364

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop File Upload for Contact Form 7 versions prior to 1.1.4

Description An arbitrary file upload flaw exists because the plugin extracts the file extension before sanitization and allows the file type parameter to be controlled by an attacker instead of restricting it to administrator-configured values. Validation is performed on the unsanitized extension, but the file is saved using a sanitized extension, allowing special characters such as $ to be stripped during the save process. This enables unauthenticated attackers to upload arbitrary PHP files, potentially leading to remote code execution. Real-world exploitability is restricted by name randomization and the presence of an .htaccess file.

Recommendations Update to a version later than 1.1.3.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-5364

Affected Products

Drag/Drop File Upload For Contact Form 7

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-5364 · Security Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-contact-form-7/tags/1.1.2/frontend/index.php#L15 · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-contact-form-7/trunk/backend/index.php#L158 · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-contact-form-7/tags/1.1.2/backend/index.php#L158 · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-contact-form-7/trunk/backend/index.php#L181 · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-contact-form-7/tags/1.1.2/backend/index.php#L181 · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-contact-form-7/trunk/frontend/index.php#L15 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3498020%40drag-and-drop-file-upload-for-contact-form-7&new=3498020%40drag-and-drop-file-upload-for-contact-form-7&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2048099315227209919 · Twitter Post
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-contact-form-7/trunk/backend/index.php#L147 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0548608d-17d5-46f4-9d64-6e3b0552bf9d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-contact-form-7/tags/1.1.2/backend/index.php#L147 · Note