CVE-2026-5718: WordPress CF7 File Upload RCE Vulnerability

CVE-2026-5718 Overview

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress contains an arbitrary file upload vulnerability in versions up to and including 1.3.9.6. The vulnerability stems from insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it. Additionally, the wpcf7_antiscript_file_name() sanitization function can be bypassed for filenames containing non-ASCII characters. This combination of flaws makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution.

Critical Impact

Unauthenticated remote attackers can upload malicious PHP files to vulnerable WordPress installations, enabling full server compromise through remote code execution without any authentication required.

Affected Products

• Drag and Drop Multiple File Upload for Contact Form 7 plugin versions up to and including 1.3.9.6
• WordPress installations using vulnerable versions of the plugin
• Any website utilizing Contact Form 7 with the affected file upload extension

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-5718 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-5718

Vulnerability Analysis

This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) allows unauthenticated attackers to bypass file upload restrictions and upload arbitrary executable files to WordPress servers. The attack is network-accessible and requires no user interaction or authentication, though exploitation complexity is elevated due to the specific conditions required.

The flaw resides in how the plugin handles file extension validation when administrators configure custom blacklist types. Rather than combining the administrator-defined blacklist with the built-in dangerous extension denylist, the custom configuration completely replaces the default security controls. This design flaw creates a scenario where seemingly secure configurations actually weaken the overall security posture.

Root Cause

The root cause is twofold. First, there is a configuration logic error where custom blacklist settings override rather than supplement the default dangerous extension denylist maintained by the plugin. Second, the wpcf7_antiscript_file_name() function, which is designed to sanitize uploaded filenames and prevent script uploads, fails to properly handle filenames containing non-ASCII characters. Attackers can craft filenames with Unicode or other non-ASCII characters to bypass this sanitization function entirely.

Attack Vector

Attackers can exploit this vulnerability remotely over the network without authentication. The attack involves uploading a malicious file (typically a PHP webshell) through a Contact Form 7 form that uses the vulnerable drag-and-drop upload functionality. By using filenames with non-ASCII characters and targeting installations where custom blacklist configurations have inadvertently disabled default protections, attackers can successfully upload executable files.

Once a PHP file is uploaded to the server, the attacker can access it directly via HTTP to execute arbitrary commands on the server. This provides full control over the WordPress installation and potentially the underlying server infrastructure, depending on server configuration and permissions.

The exploitation mechanism involves crafting a specially-named file with non-ASCII characters in the filename to bypass the wpcf7_antiscript_file_name() sanitization. When combined with a site where administrators have configured custom blacklist extensions (unknowingly replacing the default protections), the malicious file upload succeeds. For detailed technical analysis, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-5718

Indicators of Compromise

• Unexpected PHP files or other executable scripts in WordPress upload directories, particularly in paths associated with Contact Form 7 uploads
• Files with unusual non-ASCII characters in filenames within upload directories
• Web server access logs showing direct HTTP requests to files within the wp-content/uploads/ directory structure, especially PHP files
• Webshell activity indicators such as command execution patterns or suspicious outbound network connections originating from the web server

Detection Strategies

• Monitor file creation events in WordPress upload directories for executable file types (.php, .phtml, .phar)
• Implement file integrity monitoring to detect unauthorized changes to upload directories
• Review web server logs for POST requests to Contact Form 7 AJAX endpoints followed by suspicious direct file access
• Deploy web application firewall rules to detect and block file upload attempts with non-ASCII filename characters or executable extensions

Monitoring Recommendations

• Configure real-time alerting for any PHP file creation within WordPress upload directories
• Enable verbose logging for Contact Form 7 file upload operations
• Monitor for unusual patterns in form submissions, particularly large file uploads or high volumes of upload attempts
• Implement network monitoring for command-and-control traffic patterns that may indicate successful compromise

How to Mitigate CVE-2026-5718

Immediate Actions Required

• Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to the latest patched version immediately
• Audit WordPress upload directories for any suspicious files, particularly PHP files with unusual filenames
• Temporarily disable the drag-and-drop file upload functionality if immediate patching is not possible
• Review custom blacklist configurations and ensure they augment rather than replace default security controls

Patch Information

The vulnerability has been addressed in versions newer than 1.3.9.6. Organizations should update to the latest available version as documented in the WordPress ChangeSet Update. The patch corrects the blacklist merging behavior and improves the filename sanitization function to properly handle non-ASCII characters.

Workarounds

• Disable the Drag and Drop Multiple File Upload for Contact Form 7 plugin until patching is possible
• Configure web server rules to prevent execution of PHP files within upload directories (e.g., using .htaccess rules for Apache)
• Implement server-level file upload restrictions to block executable file types regardless of plugin configuration
• Use a Web Application Firewall (WAF) to filter malicious upload attempts

# Apache .htaccess configuration to prevent PHP execution in uploads directory
# Add to wp-content/uploads/.htaccess
<FilesMatch "\.(?:php|phtml|phar)$">
    Require all denied
</FilesMatch>