What the vulnerability does
01Description
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can be used to achieve remote code execution on the server via direct file access, if the server is configured to execute .phar files as PHP. The upload of .svg files allows for Stored Cross-Site Scripting under certain circumstances.
Explanation of Vulnerability in Simple Terms
02Summary
The Drag and Drop Multiple File Upload for Contact Form 7 plugin allows unauthenticated users to upload files without proper validation. An attacker can upload malicious files by tricking a site visitor into interacting with a crafted link or form. This could lead to unauthorized file storage on the server and potential site compromise depending on file type and server configuration.
What an attacker can do
03Attacker Capabilities
Upload files to the server without authentication or file type restrictions.
Potential impact on your site
04Site Impact
Malicious files could be stored on your server, potentially leading to code execution or data theft if executable files are uploaded.
Conditions required to exploit
05Prerequisites
User interaction required; attacker must trick a visitor into uploading a file via a crafted form or link.
Key dates
06Disclosure timeline
January 7, 2026
CVE published
April 8, 2026
Record updated
