EUVD-2026-63821
GHSA-rf4c-mm92-mpjf
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible public form, no auth or interaction needed, but crafting the bypass filename requires specific knowledge (AC:H); full server compromise on success justifies C/I/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.
Articles & Coverage 1
AnalysisAI
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Drag and Drop Multiple File Upload for Contact Form 7 plugin installed at a version below 1.3.9.9 and must have at least one Contact Form 7 form publicly accessible with a file upload field enabled - the upload field is not present by default in all CF7 forms and must be explicitly configured by the site administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a genuine high-severity risk: no authentication and no user interaction are required, and successful exploitation yields full server compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running a public Contact Form 7 form with file upload capability enabled via this plugin. Using the publicly available proof-of-concept, they craft a filename where the plugin's character-stripping routine transforms the name into one ending in .php, then submit the form with a PHP web shell as the file payload. … |
| Remediation | The primary fix is to update the plugin to version 1.3.9.9 or later via the WordPress plugin dashboard or direct download; the vendor patch is confirmed available per WPScan (https://wpscan.com/vulnerability/fb59519b-80ae-48e4-a31a-71d24ded205b/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-18781). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.9, or disable the plugin if immediate patching is not possible; simultaneously review web server access logs for suspicious file uploads to contact form endpoints and signs of unauthorized code execution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allow
Stored Cross-Site Scripting in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (all versions
Same weakness CWE-94 – Code Injection
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today