Path Traversal Vulnerability in Drag and Drop Multiple File Upload for Contact Form 7 Plugin

CVE-2026-5710

What is CVE-2026-5710?

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit path traversal sequences. This occurs when user-submitted filenames are directly appended to the plugin's upload URL without proper sanitization and server-side validation, permitting arbitrary file reading. Attackers can leverage this oversight to read and exfiltrate files accessible by the web server process, with the limitation that the affected files must reside in the 'wp-content' directory. This highlights the importance of validating user inputs to prevent unauthorized access to sensitive files.

References