Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
Title source: cnaExploitation Summary
CVE-2026-5718 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including xxconi, rootdirective-sec, kyukazamiqq. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains no exploit code or technical details, only a link to an external payment site (satoshidisk.com). This is a social engineering lure attempting to monetize a fake exploit.
Description
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).
Exploits (4)
The repository contains no exploit code or technical details, only a link to an external payment site (satoshidisk.com). This is a social engineering lure attempting to monetize a fake exploit.
This repository contains a functional exploit for CVE-2026-5718, targeting an unauthenticated arbitrary file upload vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin. The exploit chains two logic flaws: nonce exposure and blacklist replacement, leading to RCE via non-ASCII filename bypass.
This repository contains a functional exploit PoC for CVE-2026-5718, an arbitrary file upload vulnerability in the WordPress plugin 'Drag and Drop Multiple File Upload for Contact Form 7' version 1.3.9.6. The PoC demonstrates a local Docker lab environment with vulnerable and patched versions, showcasing the bypass of blacklist validation using non-ASCII filenames to achieve RCE.
This repository contains functional exploit code for CVE-2026-5718, targeting a vulnerability in the 'Drag and Drop Multiple File Upload for Contact Form 7' WordPress plugin. The exploit includes tools for discovering vulnerable forms and executing mass exploitation.
Nuclei Templates (1)
References (7)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H