CVE-2026-3459 is a high-severity vulnerability (CVSS 8.1) in the glenwpcoder Drag and Drop Multiple File Upload plugin for Contact Form 7. The issue arises from insufficient validation of uploaded file types in the 'dnd_upload_cf7_upload' function, allowing unauthenticated attackers to upload arbitrary files when the form permits all file types. This can potentially enable remote code execution on the server hosting the vulnerable WordPress site. The vulnerability affects versions up to and including 1.3.7.3.

An attacker can upload arbitrary files without authentication, which may lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. This can result in full system compromise, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the plugin with forms that accept all file types ('*') for multiple file uploads. Restrict accepted file types to a safe subset to reduce risk. Monitor for updates from the vendor and apply patches promptly once released.