CVE-2026-5710 is a path traversal vulnerability (CWE-22) in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin. The plugin improperly trusts client-supplied mfile[] POST parameters for email attachment selection without verifying upload provenance or enforcing directory boundaries. Filenames are appended directly to the upload URL and later converted back to filesystem paths with minimal checks (only file_exists()). This flaw allows unauthenticated attackers to read arbitrary files within the wp-content directory by crafting path traversal sequences in the mfile[] parameter, resulting in disclosure of files as email attachments.

An unauthenticated attacker can exploit this vulnerability to read and exfiltrate arbitrary files readable by the web server within the wp-content directory. This can lead to disclosure of sensitive information contained in those files. The vulnerability does not allow file modification or denial of service, but the confidentiality impact is high due to arbitrary file read capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Drag and Drop Multiple File Upload feature or restricting access to the Contact Form 7 plugin to trusted users only. Monitoring for updates from the plugin vendor or WordPress security sources is recommended to apply any forthcoming patches promptly.