Executive brief
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress allows unauthenticated users to upload files with arbitrary code content by exploiting a filename validation flaw. Attackers can bypass file type restrictions using control characters in filenames and then execute arbitrary PHP code on the server. This affects sites with non-default form configurations and servers that support directory-level configuration overrides.
Technical details
The vulnerability is a file upload validation bypass (CWE-94) in the plugin's upload handler. The plugin strips certain characters from uploaded filenames to block dangerous types, but fails to re-validate the final filename after stripping, allowing control characters (0x01) to be used to craft filenames that evade checks (e.g., "\x01evil.pha\x01r" becomes "evil.phar" after stripping). Unauthenticated attackers can exploit this by uploading PHP files or writing malicious .htaccess files to enable PHP execution of other uploaded files. The attack requires the target form to use the non-default "filetypes:*" option and the server to honour .htaccess overrides (Apache/LiteSpeed). The vulnerability was fixed in version 1.3.9.9.
Affected products
- WP Drag and Drop Drag and Drop Multiple File Upload for Contact Form 7 before 1.3.9.9
Timeline
- 2026-08-19: disclosed
- 2026-08-21: patched: Version 1.3.9.9 fixes the vulnerability