CVE-2026-5710: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the source of truth for email attachment selection without performing any server-side upload provenance check, path canonicalization, or directory containment boundary enforcement. In dnd_wpcf7_posted_data(), each user-submitted filename is directly appended to the plugin's upload URL without sanitization. In dnd_cf7_mail_components(), the URL is converted back to a filesystem path using str_replace() and only file_exists() is used as the acceptance check before attaching the file to the outgoing CF7 email. This makes it possible for unauthenticated attackers to read and exfiltrate arbitrary files readable by the web server process via path traversal sequences in the mfile[] parameter, with files being disclosed as email attachments. Note: This vulnerability is limited to the 'wp-content' folder due to the wpcf7_is_file_path_in_content_dir() function in the Contact Form 7 plugin.
AI Analysis
Technical Summary
CVE-2026-5710 is a path traversal vulnerability (CWE-22) in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin. The plugin improperly trusts client-supplied mfile[] POST parameters for email attachment selection without verifying upload provenance or enforcing directory boundaries. Filenames are appended directly to the upload URL and later converted back to filesystem paths with minimal checks (only file_exists()). This flaw allows unauthenticated attackers to read arbitrary files within the wp-content directory by crafting path traversal sequences in the mfile[] parameter, resulting in disclosure of files as email attachments.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to read and exfiltrate arbitrary files readable by the web server within the wp-content directory. This can lead to disclosure of sensitive information contained in those files. The vulnerability does not allow file modification or denial of service, but the confidentiality impact is high due to arbitrary file read capability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Drag and Drop Multiple File Upload feature or restricting access to the Contact Form 7 plugin to trusted users only. Monitoring for updates from the plugin vendor or WordPress security sources is recommended to apply any forthcoming patches promptly.
CVE-2026-5710: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7
Description
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the source of truth for email attachment selection without performing any server-side upload provenance check, path canonicalization, or directory containment boundary enforcement. In dnd_wpcf7_posted_data(), each user-submitted filename is directly appended to the plugin's upload URL without sanitization. In dnd_cf7_mail_components(), the URL is converted back to a filesystem path using str_replace() and only file_exists() is used as the acceptance check before attaching the file to the outgoing CF7 email. This makes it possible for unauthenticated attackers to read and exfiltrate arbitrary files readable by the web server process via path traversal sequences in the mfile[] parameter, with files being disclosed as email attachments. Note: This vulnerability is limited to the 'wp-content' folder due to the wpcf7_is_file_path_in_content_dir() function in the Contact Form 7 plugin.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-5710 is a path traversal vulnerability (CWE-22) in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin. The plugin improperly trusts client-supplied mfile[] POST parameters for email attachment selection without verifying upload provenance or enforcing directory boundaries. Filenames are appended directly to the upload URL and later converted back to filesystem paths with minimal checks (only file_exists()). This flaw allows unauthenticated attackers to read arbitrary files within the wp-content directory by crafting path traversal sequences in the mfile[] parameter, resulting in disclosure of files as email attachments.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to read and exfiltrate arbitrary files readable by the web server within the wp-content directory. This can lead to disclosure of sensitive information contained in those files. The vulnerability does not allow file modification or denial of service, but the confidentiality impact is high due to arbitrary file read capability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Drag and Drop Multiple File Upload feature or restricting access to the Contact Form 7 plugin to trusted users only. Monitoring for updates from the plugin vendor or WordPress security sources is recommended to apply any forthcoming patches promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-04-06T16:49:25.445Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e273aebdfbbecc5970e95c
Added to database: 4/17/2026, 5:53:50 PM
Last enriched: 4/17/2026, 6:08:15 PM
Last updated: 5/31/2026, 1:41:18 PM
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.