WordPress Plugin Flaw Exposes Sites to RCE

The Drag and Drop File Upload for Contact Form 7 plugin for WordPress, in versions up to and including 1.1.3, contains a critical arbitrary file upload vulnerability, according to the National Vulnerability Database (NVD). This flaw, tracked as CVE-2026-5364 with a CVSS score of 8.1 (HIGH), stems from a logic error in file extension handling.

The NVD explains that the plugin extracts the file extension before sanitization. Attackers can manipulate the file type parameter, bypassing administrator-configured restrictions. Crucially, validation occurs on the unsanitized extension, but the file is saved with a sanitized one. This allows special characters, like a dollar sign ($), to be stripped during the save process, effectively changing the file type after validation. Unauthenticated attackers can exploit this to upload arbitrary PHP files, leading to potential remote code execution.

While an .htaccess file and name randomization are in place, limiting real-world exploitability, the core vulnerability remains severe. Defenders running this plugin must recognize that these mitigations are not a guarantee against skilled attackers. The risk of unauthenticated RCE is real, demanding immediate attention to patch or mitigate.