CVE-2026-3459: WordPress Drag and Drop File Upload RCE Flaw

CVE-2026-3459 Overview

The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress contains an arbitrary file upload vulnerability due to insufficient file type validation in the dnd_upload_cf7_upload function. This vulnerability affects versions up to and including 1.3.7.3, allowing unauthenticated attackers to upload arbitrary files to the affected site's server, potentially enabling remote code execution.

The vulnerability is exploitable when a form includes a multiple file upload field configured with * (wildcard) as the accepted file type, which bypasses intended file type restrictions and permits the upload of malicious files such as PHP web shells.

Critical Impact

Unauthenticated remote code execution possible through arbitrary file upload, enabling complete server compromise.

Affected Products

• Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress versions up to and including 1.3.7.3

Discovery Timeline

• 2026-03-05 - CVE-2026-3459 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3459

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The core issue lies in the plugin's failure to properly validate uploaded file types before storing them on the server. When a Contact Form 7 form is configured with the Drag and Drop Multiple File Upload extension using a wildcard (*) for accepted file types, the validation logic in the dnd_upload_cf7_upload function fails to enforce proper restrictions.

The attack is network-accessible and requires no authentication, though successful exploitation depends on specific form configurations. An attacker can upload malicious files such as PHP scripts, which when accessed directly via the web server, execute arbitrary code with the privileges of the web server process.

Root Cause

The root cause stems from insufficient file type validation within the dnd_upload_cf7_upload function. When form administrators configure the file upload field to accept all file types using the wildcard character, the plugin does not implement secondary validation to block dangerous file types such as .php, .phtml, or other executable scripts. This design flaw trusts user-supplied configuration without enforcing security-critical restrictions on file uploads.

Attack Vector

The attack vector is network-based and does not require authentication. An attacker identifies a WordPress site using the vulnerable plugin with a form configured to accept wildcard file types. The attacker then crafts a malicious HTTP POST request to the form's upload endpoint, submitting a PHP web shell or similar malicious script disguised or delivered directly as an uploadable file.

Once uploaded, the attacker determines the file's storage location (often predictable based on WordPress upload directory structures) and accesses the uploaded script directly via HTTP request, triggering code execution on the server. This can lead to complete site compromise, data exfiltration, lateral movement, and persistent backdoor installation.

For technical implementation details, refer to the WordPress Plugin File Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3459

Indicators of Compromise

• Presence of unexpected .php, .phtml, or other script files in WordPress upload directories (typically wp-content/uploads/)
• Web server access logs showing POST requests to Contact Form 7 endpoints followed by GET requests to newly created files in upload directories
• Unusual outbound network connections from the web server process
• Modifications to WordPress core files, themes, or plugins by the web server user

Detection Strategies

• Monitor file system changes in WordPress upload directories for executable file types
• Implement web application firewall (WAF) rules to block file uploads containing PHP or executable content
• Review web server access logs for suspicious patterns of file upload followed by direct file access
• Deploy endpoint detection solutions to identify web shell behavior and unauthorized code execution

Monitoring Recommendations

• Enable file integrity monitoring on WordPress installations, particularly upload directories
• Configure alerts for new executable file creation in web-accessible directories
• Implement log correlation between web server access logs and file system events
• Monitor for anomalous process spawning from web server parent processes

How to Mitigate CVE-2026-3459

Immediate Actions Required

• Update the Drag and Drop Multiple File Upload - Contact Form 7 plugin to version 1.3.9.5 or later immediately
• Review all Contact Form 7 forms and remove wildcard (*) file type configurations, specifying only required file extensions
• Audit WordPress upload directories for any suspicious files that may have been uploaded during the vulnerability window
• Restrict direct access to upload directories using web server configuration

Patch Information

The vulnerability has been addressed in updated versions of the plugin. The WordPress Plugin Change Log documents the security fix. Administrators should update to version 1.3.9.5 or later, which includes proper file type validation regardless of form configuration.

Workarounds

• Replace wildcard (*) file type configurations with explicit, safe file extensions (e.g., .jpg, .png, .pdf)
• Implement server-side file type validation using .htaccess or web server configuration to deny execution of scripts in upload directories
• Use a web application firewall to inspect and block malicious file uploads before they reach the application
• Consider temporarily disabling the file upload functionality until the plugin can be updated

# Apache .htaccess configuration to prevent script execution in uploads
# Place this in the wp-content/uploads/ directory
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|phar|shtml)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Alternative: Disable PHP execution entirely in uploads
<Files *.php>
    deny from all
</Files>