What’s Vulnerable › Vulnerabilities
CVE-2026-18781: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-21 · updated 2026-10-24
- Weakness: CWE-94
Description
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.
Affected products
- Drag and Drop Multiple File Upload for Contact Form 7: before 1.3.9.9 — fixed in 1.3.9.9
How to fix
Upgrade to a fixed version: Drag and Drop Multiple File Upload for Contact Form 7 1.3.9.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-18781 or the next vulnerability affects your stack