Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-17 | 2 | Disclosure2 |
| 2026-04-19 | 1 | Disclosure1 |
| 2026-04-23 | 1 | Active Exploitation1 |
CVE-2026-5718 Arbitrary File Upload in Drag and Drop Multiple File Upload Contact Form 7 Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5718
Post summary
The post announces CVE-2026-5718, detailing an arbitrary file upload flaw in Contact Form 7’s drag‑and‑drop upload feature, but it does not provide a PoC, exploit code, or remediation guidance.
🚨 [HIGH] Active exploitation detected: CVE-2026-5718 Exploit in the wild confirmed for CVE-2026-5718 (CVSS 8.1). The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerab... 🔗 http://ctiwatch.cloud/alerts #ZeroDay #ExploitInWild #CyberSecurity
Post summary
An alert declares that CVE-2026-5718 is actively exploited in the wild against the Drag and Drop Multiple File Upload plugin for Contact Form 7, with a CVSS score of 8.1, though no PoC or patch information is provided.
CVE-2026-5718 The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.6. This is… https://www.cve.org/CVERecord?id=CVE-2026-5718
Post summary
CVE-2026-5718 identifies an arbitrary file upload vulnerability in Drag and Drop Multiple File Upload for Contact Form 7 plugin (versions up to 1.3.9.6). No exploitation or patch information is provided.
⚠️ HIGH — CVE-2026-5718 The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload i… CVSS 8.1 Full analysis → https://sec.kaitan.id/cves/CVE-2026-5718 #WordPress #CyberSecurity #InfoSec
Post summary
A high‑severity CVE-2026-5718 vulnerability (arbitrary file upload, CVSS 8.1) has been disclosed for the Contact Form 7 plugin, with analysis linked.