CVE-2026-5364: WordPress Drag and Drop File Upload RCE

CVE-2026-5364 Overview

A critical arbitrary file upload vulnerability has been discovered in the Drag and Drop File Upload for Contact Form 7 plugin for WordPress, affecting versions up to and including 1.1.3. This vulnerability stems from a flaw in the file extension validation and sanitization process that allows unauthenticated attackers to bypass file type restrictions and upload arbitrary PHP files to vulnerable WordPress installations.

The vulnerability exploits a timing mismatch between validation and sanitization operations—the plugin extracts and validates the file extension before sanitization occurs, while the file is subsequently saved with a sanitized extension. This allows special characters like $ to be used in file extensions, which pass validation but are stripped during the save process, potentially resulting in executable PHP files being stored on the server.

Critical Impact

Unauthenticated remote attackers can upload arbitrary PHP files to WordPress servers, potentially achieving remote code execution. While .htaccess restrictions and filename randomization provide some mitigation, sophisticated attackers may still exploit this vulnerability.

Affected Products

• Drag and Drop File Upload for Contact Form 7 plugin for WordPress versions ≤ 1.1.3
• WordPress installations using the vulnerable plugin versions
• Contact Form 7 implementations with the affected file upload extension

Discovery Timeline

• April 24, 2026 - CVE-2026-5364 published to NVD
• April 24, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5364

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue lies in the improper sequencing of file validation and sanitization operations within the plugin's upload handling code.

The plugin allows the file type parameter to be controlled by the attacker rather than being restricted to administrator-configured values. When processing uploaded files, the extension is extracted for validation before any sanitization takes place. However, when the file is actually saved to disk, the extension undergoes sanitization that strips special characters. This creates a dangerous mismatch where a file named shell.php$ would pass validation (as php$ may not be in the blocklist) but be saved as shell.php after the $ character is stripped.

While the plugin implements .htaccess restrictions to prevent direct execution and uses filename randomization to obscure uploaded files, these defenses can potentially be circumvented by determined attackers, especially in misconfigured environments or through additional attack vectors.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) style vulnerability in the file upload validation logic. The vulnerability occurs at multiple points in the code:

1. Extension extraction timing - The file extension is extracted before sanitization, creating a validation bypass opportunity
2. Attacker-controlled file type parameter - The file type is accepted from user input rather than enforced from administrator settings
3. Validation vs. save mismatch - Validation occurs on the unsanitized extension while the file is saved with the sanitized extension

This architectural flaw allows attackers to craft filenames that pass the security checks but result in dangerous file types after sanitization processing.

Attack Vector

The attack can be executed remotely over the network without any authentication. An attacker can exploit this vulnerability by:

1. Identifying a WordPress site using the vulnerable Drag and Drop File Upload for Contact Form 7 plugin
2. Crafting a malicious file upload request with a specially crafted filename containing special characters (e.g., malicious.php$)
3. Submitting the upload through the Contact Form 7 interface
4. The validation logic accepts the file as the extension php$ may not match blocked extensions
5. During the save process, the $ character is stripped, resulting in malicious.php being written to the server
6. If .htaccess protections can be bypassed or the attacker can determine the randomized filename, remote code execution may be achieved

Technical details of the vulnerable code can be reviewed in the WordPress Plugin Code Review - Line 147, Line 158, and Line 181.

Detection Methods for CVE-2026-5364

Indicators of Compromise

• Unexpected PHP files appearing in the WordPress uploads directory, particularly in Contact Form 7 upload folders
• Files with randomized names but .php extensions in upload directories
• Web server access logs showing POST requests to Contact Form 7 endpoints with unusual file extensions containing special characters
• Modifications or deletions of .htaccess files in upload directories

Detection Strategies

• Monitor file system events for new PHP files created in the wp-content/uploads directory and subdirectories
• Implement web application firewall (WAF) rules to detect file upload attempts with special characters in extensions
• Review Apache/Nginx access logs for POST requests to admin-ajax.php or form submission endpoints with suspicious payloads
• Deploy file integrity monitoring to detect unexpected PHP files in upload directories

Monitoring Recommendations

• Enable detailed logging on Contact Form 7 form submissions and file uploads
• Configure alerts for any new executable file types (.php, .phtml, .phar) created in upload directories
• Monitor web server error logs for attempts to execute files in restricted directories
• Implement periodic scans of upload directories to identify potentially malicious files

How to Mitigate CVE-2026-5364

Immediate Actions Required

• Update the Drag and Drop File Upload for Contact Form 7 plugin to the latest patched version immediately
• Audit existing upload directories for any suspicious PHP files that may have been uploaded
• Verify that .htaccess protections in upload directories have not been modified or deleted
• Consider temporarily disabling file upload functionality on Contact Form 7 forms until patched

Patch Information

A security update has been released to address this vulnerability. The patch corrects the validation and sanitization sequence to ensure file extensions are properly validated after sanitization occurs. Administrators should update to the latest version available through the WordPress plugin repository.

Review the patch changes in the WordPress Plugin Changeset Review for technical details on the fix. Additional vulnerability information is available in the Wordfence Vulnerability Report.

Workarounds

• Implement strict allowlist-based file extension validation at the web server level, blocking all files except explicitly permitted types
• Add additional .htaccess rules to deny PHP execution in upload directories: php_flag engine off
• Use a Web Application Firewall (WAF) to block requests containing file uploads with special characters in filenames
• Temporarily remove or disable the vulnerable plugin until the patch can be applied

# Configuration example - Add to .htaccess in upload directory
# Deny PHP execution in upload folders
<FilesMatch "\.ph(p[3457]?|t|tml)$">
    Require all denied
</FilesMatch>

# Alternative: Disable PHP engine entirely
php_flag engine off