Junglewise Threat Intelligence

CVE-2026-5718: WordPress Drag and Drop Multiple File Upload arbitrary file upload

CVE-2026-5718 · Severity: high · CVSS 8.1 · Published 2026-04-17

Technologies: CodePeople Drag and Drop Multiple File Upload for Contact Form 7. Vendors: CodePeople.

Executive brief

A popular WordPress plugin used for adding file upload capabilities to contact forms is vulnerable to a security flaw that allows unauthorized file uploads. An attacker can exploit this to upload malicious scripts, such as PHP files, directly to the web server. If successful, this could lead to a complete takeover of the website, allowing the attacker to steal data, modify content, or disrupt operations.

Technical details

The vulnerability is classified as an unrestricted file upload (CWE-434) due to two primary flaws in the plugin's validation logic. First, when custom blacklist types are configured, the plugin replaces the default dangerous extension denylist instead of merging with it, potentially leaving dangerous extensions like .php allowed. Second, the wpcf7_antiscript_file_name() sanitization function can be bypassed by using filenames containing non-ASCII characters. These flaws allow unauthenticated attackers to upload arbitrary PHP files via the network. While a partial patch was released in version 1.3.9.7, a bypass was subsequently discovered, necessitating further updates.

Affected products

  • CodePeople Drag and Drop Multiple File Upload for Contact Form 7 up to, and including, 1.3.9.7

Timeline

  • 2026-04-17: disclosed
  • 2026-04-17: advisory
  • 2026-05-26: other: Advisory updated to include patch bypass information and version 1.3.9.7.

References