What is the CVSS score of CVE-2026-5718?

CVE-2026-5718 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-5718?

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions ≤1.3.9.6) contains a remote code execution vulnerability that permits unauthenticated attackers to upload…

Is there a public PoC exploit available for CVE-2026-5718?

Yes, a public proof-of-concept exploit is available for CVE-2026-5718. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-5718?

Within 24 hours: Disable or remove the Drag and Drop Multiple File Upload for Contact Form 7 plugin from all WordPress instances running versions ≤1.3.9.6; verify no unauthorized files were uploaded via file integrity checks. Within 7 days: Update to plugin version >1.3.9.6 if available, or implement a permanent alternative file upload solution; audit web server logs (past 90 days minimum) for suspicious upload activity and PHP execution in upload directories. Within 30 days: Conduct full WordPress security assessment; implement web application firewall rules to restrict PHP execution in upload directories; establish file upload monitoring and vulnerability scanning procedures.

PHP CVE-2026-5718

EUVD-2026-23459 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-17 Wordfence

GHSA-xj7v-jqv6-v48w

PHP WordPress RCE File Upload Drag And Drop Multiple File Upload For Contact Form 7 Wordpress Plugin Glenwpcoder

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 18:44 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 18:15 euvd

EUVD-2026-23459

Analysis Generated

Apr 17, 2026 - 18:15 vuln.today

CVE Published

Apr 17, 2026 - 17:25 nvd

HIGH 8.1

DescriptionCVE.org

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.6. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution.

AnalysisAI

Remote code execution in Drag and Drop Multiple File Upload for Contact Form 7 plugin (WordPress) versions ≤1.3.9.6 allows unauthenticated attackers to upload PHP webshells via dual file validation weaknesses. The plugin's custom blacklist configuration overwrites default protections instead of merging, and non-ASCII filenames bypass the wpcf7_antiscript_file_name() sanitizer. CVSS 8.1 with High attack complexity (AV:N/AC:H/PR:N/UI:N). Wordfence reported; patch released in changeset 3508522. No KEV listing or confirmed public exploitation, but proof-of-concept feasible given detailed vulnerable code references (lines 62, 883, 970, 987).

Technical ContextAI

This vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type) in a WordPress Contact Form 7 extension plugin. The plugin implements file upload handling with two critical flaws: (1) When administrators configure custom file type blacklists, the plugin replaces the default dangerous extension denylist (e.g., .php, .phtml, .php5) rather than merging additions, leaving critical extensions unprotected. (2) The wpcf7_antiscript_file_name() function designed to sanitize filenames fails when processing non-ASCII characters, allowing attackers to craft filenames like 'shell.phÞ' or using Unicode homoglyphs to evade detection. The affected CPE (cpe:2.3:a:glenwpcoder:drag_and_drop_multiple_file_upload_for_contact_form_7) identifies the specific product. Vulnerable code sections at lines 62 (blacklist logic), 883-970 (filename handling), and 987 (upload execution) confirm the dual-path bypass mechanism. This is a classic defense-in-depth failure where two independent security controls both fail under specific conditions.

RemediationAI

Upgrade immediately to version 1.3.9.7 or later, which addresses both the blacklist merging logic and non-ASCII filename sanitization issues per WordPress plugin repository changeset 3508522 (https://plugins.trac.wordpress.org/changeset/3508522/drag-and-drop-multiple-file-upload-contact-form-7). The patch merges custom blacklists with default dangerous extensions and strengthens wpcf7_antiscript_file_name() to handle Unicode characters. If immediate patching is not feasible, implement these temporary controls: (1) Remove all custom file type blacklist configurations to restore default protections - accept the trade-off of potentially blocking legitimate file types users previously uploaded; (2) Configure web server rules to block execution of .php, .phtml, .php5, .php7 files in the wp-content/uploads directory (for Apache, use 'php_flag engine off' in .htaccess; for Nginx, remove php location blocks for uploads path) - note this may break legitimate upload processing scripts if poorly configured; (3) Deploy file integrity monitoring on wp-content/uploads to detect unexpected PHP files; (4) Review existing uploads for suspicious PHP files created since plugin installation. Each workaround has limitations and should not replace upgrading.