Is CVE-2026-18781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18781 being exploited in the wild.

How severe is CVE-2026-18781?

High severity, with a CVSS score of 8.1, published 21 August 2026.

Is there a fix for CVE-2026-18781?

A patch was published on 2026-08-21: Version 1.3.9.9 fixes the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18781 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18781?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18781: Drag and Drop Multiple File Upload for Contact Form 7 RCE via filename bypass

CVE-2026-18781 · Severity: high · CVSS 8.1 · Published 2026-08-21

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress allows unauthenticated users to upload files with arbitrary code content by exploiting a filename validation flaw. Attackers can bypass file type restrictions using control characters in filenames and then execute arbitrary PHP code on the server. This affects sites with non-default form configurations and servers that support directory-level configuration overrides.

Quick answers

Is CVE-2026-18781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18781 being exploited in the wild.
How severe is CVE-2026-18781?: High severity, with a CVSS score of 8.1, published 21 August 2026.
Which products and versions are affected?: WP Drag and Drop Drag and Drop Multiple File Upload for Contact Form 7 before 1.3.9.9.
Is there a fix for CVE-2026-18781?: A patch was published on 2026-08-21: Version 1.3.9.9 fixes the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18781 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18781?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a file upload validation bypass (CWE-94) in the plugin's upload handler. The plugin strips certain characters from uploaded filenames to block dangerous types, but fails to re-validate the final filename after stripping, allowing control characters (0x01) to be used to craft filenames that evade checks (e.g., "\x01evil.pha\x01r" becomes "evil.phar" after stripping). Unauthenticated attackers can exploit this by uploading PHP files or writing malicious .htaccess files to enable PHP execution of other uploaded files. The attack requires the target form to use the non-default "filetypes:*" option and the server to honour .htaccess overrides (Apache/LiteSpeed). The vulnerability was fixed in version 1.3.9.9.

Affected products

WP Drag and Drop Drag and Drop Multiple File Upload for Contact Form 7 before 1.3.9.9

Timeline

2026-08-19: disclosed
2026-08-21: patched: Version 1.3.9.9 fixes the vulnerability

References

https://wpscan.com/vulnerability/fb59519b-80ae-48e4-a31a-71d24ded205b/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.