Arbitrary file upload affecting WordPress Drag and Drop File Upload for Contact Form 7 plugin
An arbitrary file upload vulnerability affecting the WordPress Drag and Drop File Upload for Contact Form 7 plugin would allow an unauthenticated attacker to upload arbitrary files.
Description
Technical context and vulnerability details
Drag and Drop File Upload for Contact Form 7 is a WordPress plugin for integrating a drag and drop file upload form into Contact Form 7. This plugin is affected by a vulnerability labeled CVE-2026-5364 resulting from insufficient validation of the uploaded file type allowing an unauthenticated malicious actor to upload PHP files and potentially execute malicious code remotely. This vulnerability is classified as high with a severity score of 8.1 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- Versions of Drag and Drop File Upload for Contact Form 7 (WordPress plugin) prior to 1.1.3 included;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Drag and Drop File Upload for Contact Form 7 plugin to version 1.1.4 or higher;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.