Vulnerability · Published Apr 17, 2026 · Assigned by Wordfence

CVE-2026-5718Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

High 8.1

In plain English

A high-severity unrestricted file upload in Drag and Drop Multiple File Upload for Contact Form 7 from glenwpcoder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)4.2%top 9.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).

Affected products (as reported)

Vendor	Product	Versions
glenwpcoder	Drag and Drop Multiple File Upload for Contact Form 7	0 – through 1.3.9.7

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References