Vulnerability · Published Aug 21, 2026 · Assigned by WPScan
CVE-2026-18781Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
High 8.1
In plain English
A high-severity code injection in Drag and Drop Multiple File Upload for Contact Form 7 from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Drag and Drop Multiple File Upload for Contact Form 7 | 0 – before 1.3.9.9 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/fb59519b-80ae-48e4-a31a-71d24ded205b/ exploit, vdb-entry, technical-description