CVE-2026-57188.1HighCWE-434

CVE-2026-5718: Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

glenwpcoder · Drag and Drop Multiple File Upload for Contact Form 7

Affected: glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

5.4%probability of exploitation in the next 30 days

92nd percentile

050100

Higher than 92% of scored CVEs

8.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

glenwpcoder · Drag and Drop Multiple File Upload for Contact Form 7up to and including 1.3.9.7

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution · nuclei template in projectdiscovery/nuclei-templates
Weakness: Unrestricted File Upload · File and Path Handling
Vendor: glenwpcoder
Published: April 2026
Band: Check available, not yet exploited, April 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-5718 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.