WordPress Plugin RCE: Drag and Drop File Upload Flaw

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload, affecting versions up to and including 1.3.9.6, according to the National Vulnerability Database. This high-severity flaw (CVSS 8.1) stems from inadequate file type validation when custom blacklist types are configured. Instead of augmenting the default dangerous extension denylist, these custom settings replace it, creating a critical bypass.

Further complicating matters, the wpcf7_antiscript_file_name() sanitization function can be bypassed by using non-ASCII characters in filenames. This combination allows unauthenticated attackers to upload arbitrary files, including PHP files, directly to the server. The consequence is clear: remote code execution (RCE) on affected WordPress instances, a nightmare scenario for any defender.

This isn’t just a theoretical flaw; it’s a direct path to server compromise. Attackers can leverage this to establish persistent access, exfiltrate data, or pivot further into the network. For any organization running WordPress with this plugin, the immediate risk is severe and warrants urgent attention.