What is the CVSS score of CVE-2026-5364?

CVE-2026-5364 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Drag and Drop File Upload for Contact Form 7 are affected by CVE-2026-5364?

The Drag and Drop File Upload for Contact Form 7 plugin (versions ≤1.1.3) contains a remote code execution vulnerability that allows unauthenticated attackers to upload malicious PHP files by…

How to fix or mitigate CVE-2026-5364?

Within 24 hours: Identify all WordPress instances running Contact Form 7 with Drag and Drop File Upload plugin version ≤1.1.3 and disable the plugin immediately. Within 7 days: Upgrade to Contact Form 7 version 5.8+ and verify Drag and Drop File Upload plugin is at the latest available version; review server logs and uploaded files for suspicious PHP files. Within 30 days: Implement file upload restrictions via .htaccess to deny PHP execution in upload directories, enforce strict MIME type validation, and deploy Web Application Firewall rules to block suspicious file upload patterns.

Drag and Drop File Upload for Contact Form 7 CVE-2026-5364

EUVD-2026-25399 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-24 Wordfence

GHSA-8q7x-g4f6-63gp

PHP WordPress File Upload RCE

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 24, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 06:00 euvd

EUVD-2026-25399

Analysis Generated

Apr 24, 2026 - 06:00 vuln.today

CVE Published

Apr 24, 2026 - 05:29 nvd

HIGH 8.1

DescriptionCVE.org

The Drag and Drop File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.1.3. This is due to the plugin extracting the file extension before sanitization occurs and allowing the file type parameter to be controlled by the attacker rather than being restricted to administrator-configured values, which when combined with the fact that validation occurs on the unsanitized extension while the file is saved with a sanitized extension, allows special characters like '$' to be stripped during the save process. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and potentially achieve remote code execution, however, an .htaccess file and name randomization is in place which restricts real-world exploitability.

AnalysisAI

Remote code execution in Drag and Drop File Upload for Contact Form 7 plugin (≤1.1.3) allows unauthenticated attackers to upload arbitrary PHP files via a sanitization bypass vulnerability. The flaw exploits a race condition where file extension validation occurs on unsanitized input while the file saves with a sanitized extension, enabling special characters like '$' to be stripped mid-process. Exploitability is constrained by .htaccess restrictions and filename randomization, reducing real-world risk despite the 8.1 CVSS score. EPSS data not available; no active exploitation or POC publicly confirmed at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type) in a WordPress plugin that extends Contact Form 7 with file upload capabilities. The flaw involves a time-of-check-time-of-use (TOCTOU) issue where the plugin extracts and validates the file extension before sanitization, but allows attackers to control the file type parameter independently of administrator-configured restrictions. The validation logic checks the unsanitized extension while the save operation uses a sanitized version, creating an exploitable gap. When an attacker crafts a filename with special characters (e.g., 'malicious.php$.jpg'), the validation sees '.jpg' as safe, but sanitization strips the '$' during save, resulting in 'malicious.php' being written to disk. The affected component (cpe:2.3:a:addonsorg:drag_and_drop_file_upload_for_contact_form_7) processes file uploads in frontend/index.php and backend/index.php, with the vulnerable code path visible in lines 147-181 of the backend handler and line 15 of the frontend handler according to source code references.

RemediationAI

Update to version 1.1.4 or later if available, as indicated by the changeset reference https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3498020%40drag-and-drop-file-upload-for-contact-form-7&new=3498020%40drag-and-drop-file-upload-for-contact-form-7 showing code changes addressing the vulnerability. If immediate patching is not possible, implement compensating controls: (1) disable the plugin entirely until patched version is installed, with the trade-off of losing drag-and-drop file upload functionality in Contact Form 7 forms; (2) restrict file upload capabilities to authenticated users only via WordPress role configuration, which conflicts with the plugin's intended use case for public form submissions; (3) add server-level MIME type validation and execution restrictions in web server configuration beyond .htaccess, though this requires sysadmin access; (4) implement web application firewall (WAF) rules to block requests with suspicious filename patterns containing special characters before sanitization. Monitor WordPress plugin repository for official security advisories from the vendor (addonsorg).