CVE-2026-5364 is a vulnerability in the Drag and Drop File Upload for Contact Form 7 WordPress plugin (versions up to 1.1.3) that allows unauthenticated attackers to upload arbitrary files, including PHP scripts. The root cause is that the plugin extracts the file extension before sanitization and permits the file type parameter to be attacker-controlled rather than restricted to administrator-configured values. Validation is performed on the unsanitized extension, while the file is saved with a sanitized extension, allowing special characters like '$' to be stripped during saving. This discrepancy enables attackers to bypass restrictions and upload executable files. Although mitigations such as an .htaccess file and filename randomization are in place, these do not fully eliminate the risk of remote code execution. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to arbitrary file upload of PHP files by unauthenticated attackers, which may result in remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system. However, the presence of an .htaccess file and filename randomization reduces the likelihood of exploitation in real-world scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the vulnerable plugin version and monitor for updates from the vendor. The existing .htaccess and filename randomization provide some mitigation but do not fully prevent exploitation.