File Upload Vulnerability in Drag and Drop Multiple File Upload for Contact Form 7 Plugin
CVE-2026-14325

Currently unrated

Key Information:

Vendor

WordPress
Status
Drag And Drop Multiple File Upload For Contact Form 7
Vendor
CVE Published:
21 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-14325?

The Drag and Drop Multiple File Upload for Contact Form 7 plugin, prior to version 1.3.9.9, contains a vulnerability where it fails to properly escape one of its settings used as an HTML tag name during front-end output. This flaw enables users with administrator access to inject arbitrary web scripts, which can execute on any front-end page that renders its upload field. Consequently, this exposes the site to significant security risks, allowing unauthorized actions and data access via code execution.

Affected Version(s)

Drag and Drop Multiple File Upload for Contact Form 7 0 < 1.3.9.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-14325 - Proof of Concept

References

https://wpscan.com/vulnerability/fc723849-62d3-4c87-a0ad-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sai Praneeth Koti
WPScan
.