CVE-2026-5718 affects the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress, enabling unauthenticated attackers to upload arbitrary files due to insufficient file type validation when custom blacklists replace the default denylist and a sanitization function is bypassed for filenames with non-ASCII characters. This vulnerability can lead to remote code execution on the affected server. Although a partial patch was introduced in version 1.3.9.7, a bypass to this patch was later reported, indicating the vulnerability remains exploitable. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required. No official remediation level or patch links are provided, and no known exploits in the wild have been documented.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable PHP scripts, to the web server hosting the vulnerable plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.1) reflects the critical nature of this impact. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A partial patch was released in version 1.3.9.7; however, a bypass was discovered, indicating incomplete mitigation. Until a complete fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official vendor channels for updates and patches addressing this vulnerability.