Arbitrary File Upload Vulnerability in Drag and Drop File Upload Plugin for WordPress

CVE-2026-5364

What is CVE-2026-5364?

The Drag and Drop File Upload plugin for Contact Form 7 allows unauthenticated attackers to exploit a vulnerability that permits arbitrary file uploads. This occurs due to the improper handling of file extensions, which are extracted without adequate sanitization. Attackers can take advantage of this flaw by controlling the file type parameter, leading to potential remote code execution. Although measures such as .htaccess restrictions and filename randomization are implemented, they may not fully mitigate all risks associated with this vulnerability, highlighting the need for immediate patching and proactive security measures.

References