CF7 Upload Plugin CVE-2026-18781

The target WordPress site must have the Drag and Drop Multiple File Upload for Contact Form 7 plugin installed at a version below 1.3.9.9 and must have at least one Contact Form 7 form publicly accessible with a file upload field enabled - the upload field is not present by default in all CF7 forms and must be explicitly configured by the site administrator. The web server must execute PHP files located in the WordPress uploads directory (the default WordPress configuration does not restrict this). No authentication, session, or prior account is required from the attacker. Exploitation is limited to sites meeting these deployment conditions; sites without public upload-enabled CF7 forms are not reachable via this vector.

The CVSS 8.1 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a genuine high-severity risk: no authentication and no user interaction are required, and successful exploitation yields full server compromise. The AC:H rating acknowledges that the attacker must craft a filename specifically suited to bypass the strip logic, which introduces real but not prohibitive complexity - especially since a publicly available proof-of-concept already encodes this technique, effectively collapsing the practical complexity for opportunistic attackers. No EPSS score was provided in the intelligence data; this is a notable gap. The absence of a CISA KEV listing means active mass exploitation is not yet confirmed, but the combination of a public POC, unauthenticated network access, and a very large WordPress plugin install base elevates the realistic threat well above what CVSS alone conveys. The S:U (scope unchanged) rating is appropriate since exploitation is bounded to the web server's PHP execution context. No conflicting signals exist between the CVSS vector and the description - both consistently indicate unauthenticated network exploitation with no user interaction.

An attacker identifies a WordPress site running a public Contact Form 7 form with file upload capability enabled via this plugin. Using the publicly available proof-of-concept, they craft a filename where the plugin's character-stripping routine transforms the name into one ending in .php, then submit the form with a PHP web shell as the file payload. Once uploaded, the attacker directly requests the file's URL in the wp-content/uploads directory, achieving arbitrary server-side code execution under the web server's process account.