Filename sanitization bypass allows unauthenticated upload and code execution in Drag and Drop Multiple File Upload for Contact Form 7 (CVE-2026-18781)
VulnCheck added this to its known-exploited catalog on 2026-08-24 citing a Patchstack exploitation report, and any site still running a version below 1.3.9.9 is open to unauthenticated file-upload takeover.
The plugin strips characters from an uploaded file's name but never re-validates the resulting final name, so unauthenticated attackers can defeat its file type restrictions and place executable files on the server, leading to arbitrary code execution.
Affected: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9
How to Test
Confirm the installed plugin version in the WordPress admin or via the plugin file header; anything below 1.3.9.9 is vulnerable. Review the uploads directory used by the plugin for unexpected PHP or otherwise executable files and check web server access logs for POSTs to the plugin's upload endpoint from unauthenticated clients.
How to Patch
Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.9 or later. If you cannot update immediately, deactivate the plugin until you can, and remove any attacker-written files found in the uploads path.