CVE-2026-3459Disclosure

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if the form includes a multiple file upload field with ‘*’ as the accepted file type.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 2d ago at 1 mentions (2026-03-05); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

The Hacker Wire@TheHackerWire214d
Disclosure
🟠 CVE-2026-3459 - High The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' fun... https://www.thehackerwire.com/vulnerability/CVE-2026-3459/ https://t.co/iiPHuwp4l6
Post summary
The tweet announces a high‑severity vulnerability (CVE‑2026‑3459) in the Contact Form 7 plugin, detailing insufficient file type validation that allows arbitrary uploads.
0000047
130 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds217d
Disclosure
CVE-2026-3459 Unauthenticated Arbitrary File Upload Vulnerability in Contact Form 7 Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3459
Post summary
The text announces CVE-2026-3459 as an unauthenticated arbitrary file upload vulnerability in the Contact Form 7 plugin, linking to a details page without further technical or mitigation information.
0000056
4.0K followersView on X
CVE@CVEnew217d
Disclosure
CVE-2026-3459 The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dn… https://www.cve.org/CVERecord?id=CVE-2026-3459
Post summary
CVE-2026-3459 details an arbitrary file upload flaw in the Contact Form 7 "Drag and Drop Multiple File Upload" plugin, caused by inadequate file type validation.
00000106
56.6K followersView on X

Explore more

Back to dashboard