CVE-2026-5718highexploração observadaCWE-434

CVE-2026-5718: falha de alta gravidade em glenwpcoder Drag and Drop Multiple File Upload…

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Drag and Drop Multiple File Upload for Contact Form

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

78Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 8.1epss 4.2%
da publicação à arma21 dias
Publicada no NVD17 de abr.
1ª PoC+21d
VulnCheck+3d
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
glenwpcoder · Drag and Drop Multiple File Upload for Contact Form 7
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — glenwpcoder Drag and Drop Multiple File Upload…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-3515HIGHDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist ChecksEPSS 6.0%CVE-2023-5822HIGHDrag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File UploadEPSS 2.2%CVE-2025-2328HIGHDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File DeletionEPSS 1.1%CVE-2025-8464MEDIUMDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` CookieEPSS 0.7%CVE-2024-3717MEDIUMDrag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information ExposureEPSS 0.7%CVE-2026-5710HIGHDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile FieldEPSS 0.7%