Path Traversal in WordPress Plugin Exposes Files

The National Vulnerability Database has identified a critical path traversal vulnerability, CVE-2026-5710, affecting the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. Versions up to and including 1.3.9.6 are susceptible to arbitrary file reads, scoring a CVSS 7.5 (High).

This flaw stems from the plugin’s failure to properly validate client-supplied mfile[] POST values. It directly appends user-submitted filenames to its upload URL without sanitization or server-side checks. This means an unauthenticated attacker can manipulate the mfile[] parameter with path traversal sequences to read and exfiltrate any file accessible by the web server process. The files are then disclosed as email attachments via outgoing Contact Form 7 emails.

While the vulnerability is severe, its scope is limited to the wp-content folder due to the wpcf7_is_file_path_in_content_dir() function in the main Contact Form 7 plugin. This doesn’t make it any less dangerous for sensitive configurations or data within that directory. Defenders need to understand that this isn’t just a theoretical bug; it’s a direct path to data exfiltration for unauthenticated attackers.