CVE-2026-5718: CWE-434 Unrestricted Upload of File with Dangerous Type in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.6. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution.
AI Analysis
Technical Summary
CVE-2026-5718 is a high-severity vulnerability (CVSS 8.1) in the glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. The issue is caused by insufficient validation of uploaded file types when custom blacklists are used, which override the default denylist instead of merging with it. Additionally, the wpcf7_antiscript_file_name() sanitization function can be bypassed using filenames containing non-ASCII characters. This combination allows unauthenticated attackers to upload arbitrary files, including potentially executable PHP files, leading to remote code execution on the affected server. The vulnerability affects versions up to and including 1.3.9.6. No vendor advisory or patch information is currently available.
Potential Impact
Successful exploitation allows unauthenticated attackers to upload arbitrary files, such as PHP scripts, to the server. This can result in remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability poses a high risk to WordPress sites using the affected plugin versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using the vulnerable plugin versions or disable the plugin to prevent exploitation. Monitor official channels for updates and apply patches promptly once available.
CVE-2026-5718: CWE-434 Unrestricted Upload of File with Dangerous Type in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7
Description
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.6. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-5718 is a high-severity vulnerability (CVSS 8.1) in the glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. The issue is caused by insufficient validation of uploaded file types when custom blacklists are used, which override the default denylist instead of merging with it. Additionally, the wpcf7_antiscript_file_name() sanitization function can be bypassed using filenames containing non-ASCII characters. This combination allows unauthenticated attackers to upload arbitrary files, including potentially executable PHP files, leading to remote code execution on the affected server. The vulnerability affects versions up to and including 1.3.9.6. No vendor advisory or patch information is currently available.
Potential Impact
Successful exploitation allows unauthenticated attackers to upload arbitrary files, such as PHP scripts, to the server. This can result in remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability poses a high risk to WordPress sites using the affected plugin versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using the vulnerable plugin versions or disable the plugin to prevent exploitation. Monitor official channels for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-04-06T18:35:21.089Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e273aebdfbbecc5970e963
Added to database: 4/17/2026, 5:53:50 PM
Last enriched: 4/17/2026, 6:08:04 PM
Last updated: 4/17/2026, 7:29:58 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.