CVE-2026-5364 is a high-severity vulnerability in the Drag and Drop File Upload for Contact Form 7 plugin for WordPress, affecting versions up to 1.1.3. The issue arises because the plugin validates file types based on an unsanitized extension while saving files with a sanitized extension, allowing attackers to bypass restrictions by using special characters like '$'. This enables unauthenticated attackers to upload arbitrary PHP files, potentially leading to remote code execution. Mitigating factors include the presence of an .htaccess file and filename randomization, which limit real-world exploitability. No patch or official remediation level is currently documented.

Successful exploitation could allow unauthenticated attackers to upload arbitrary PHP files, potentially leading to remote code execution with high impact on confidentiality, integrity, and availability. However, existing mitigations such as .htaccess restrictions and filename randomization reduce the practical exploitability of this vulnerability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the vulnerable plugin or restricting file upload capabilities. Monitor vendor channels for updates and apply patches promptly once released.