What is the CVSS score of CVE-2026-3459?

CVE-2026-3459 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-3459?

WordPress sites using the Drag and Drop Multiple File Upload - Contact Form 7 plugin (versions up to 1.3.7.3) face critical risk of unauthorized file uploads and potential server compromise.

How to fix or mitigate CVE-2026-3459?

Within 24 hours: Identify all WordPress installations using this plugin and document current versions; disable the multiple file upload feature in affected forms as a temporary measure. Within 7 days: Contact the plugin vendor for patch status and timeline; implement Web Application Firewall (WAF) rules to block suspicious file uploads; review recent upload logs for suspicious activity. Within 30 days: Apply vendor patch immediately upon release; conduct forensic analysis of upload directories for malicious files; restore from clean backup if compromise is suspected; implement file upload restrictions at the web server level.

WordPress CVE-2026-3459

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-05 security@wordfence.com

WordPress RCE File Upload

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 8.1

DescriptionCVE.org

The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if the form includes a multiple file upload field with ‘*’ as the accepted file type.

AnalysisAI

Unauthenticated attackers can upload arbitrary files to WordPress sites running the Drag and Drop Multiple File Upload - Contact Form 7 plugin through versions 1.3.7.3 due to insufficient file type validation when wildcard characters are configured in upload fields. Successful exploitation could enable remote code execution on the affected server. No patch is currently available.

Technical ContextAI

This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects Drag and Drop Multiple File Upload - Contact Form 7 (WordPress plugin). The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if the form includes a multiple file upload field with ‘*’ as the accepted file t

Affected ProductsAI

Vendor: WordPress. Product: Drag and Drop Multiple File Upload - Contact Form 7 (WordPress plugin).

RemediationAI

Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.