Description

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-21T07:16:25.143Z",
  "pubdate": "2026-08-21T07:16:25.143Z",
  "executiveSummary": "An arbitrary file upload vulnerability exists in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin in versions prior to 1.3.9.9. The flaw stems from insufficient validation of the final filename after character sanitization is performed during the upload process. Unauthenticated remote attackers can leverage this security deficiency to bypass implemented file type restrictions, facilitating the upload and subsequent execution of malicious scripts on the underlying server. Successful exploitation grants the adversary the capability to execute arbitrary code within the context of the web server user, potentially leading to total compromise of the hosting environment. The risk level is critical due to the lack of authentication requirements and the severity of remote code execution capabilities. Remediation requires updating the affected plugin to version 1.3.9.9 or later, where proper post-sanitization filename validation is enforced.",
  "technicalDetails": "The vulnerability resides within the file processing logic of the Drag and Drop Multiple File Upload for Contact Form 7 plugin, specifically affecting versions prior to 1.3.9.9. The root cause of the flaw is a post-sanitization validation bypass. When a user uploads a file, the plugin performs an initial inspection and sanitization routine to strip disallowed characters or extensions from the filename. However, the plugin fails to properly re-validate the resulting final filename after these sanitization operations are completed. This logical disconnect allows an attacker to craft specially manipulated file names containing double extensions, null bytes, or specific character sequences that resolve to executable formats (such as PHP scripts) only after the sanitization filters have stripped away the obstructing characters.\nExploitation of this vulnerability requires no prior authentication or elevated privileges, making it accessible to any unauthenticated network attacker capable of reaching the WordPress installation where the vulnerable contact form is hosted. The attack flow initiates with the adversary crafting a malicious payload disguised as an allowed file type or engineered to mutate into an executable script post-sanitization. The attacker then interacts with the contact form endpoint, submitting the malicious file through the drag-and-drop upload component. Because the vulnerable component evaluates the file extension prior to character stripping or fails to inspect the resultant string, the payload is successfully written to the server's filesystem.\nFollowing successful file storage, the attacker can execute the payload by directly querying the file path via HTTP requests, assuming the upload directory lacks proper execution restrictions. This leads to arbitrary code execution on the server with the privileges of the web server user. Post-exploitation impact typically includes complete system compromise, unauthorized access to sensitive database contents, lateral movement within the network, or the deployment of web shells and secondary malware."
}