CVE-2026-18781: Unauthenticated RCE via Filename Bypass in WP Plugin Drag and Drop Multiple File Upload

Vulnerability Overview Title: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass Description: The plugin fails to validate the final uploaded filename after stripping characters from the filename, allowing unauthenticated users to bypass file type restrictions and execute arbitrary code on the server. Exploitation Conditions: Requires non-default field configuration and server support for per-directory configuration overrides. Affected Versions Affected Plugin: drag-and-drop-multiple-file-upload-contact-form-7 Fixed Version: 1.3.9.9 Remediation Fixed Version: Upgrade to version 1.3.9.9 or later. Additional Information CVE Number: CVE-2026-18781 Type: RCE (Remote Code Execution) OWASP Top 10: A1: Injection CWE: CWE-94 CVSS Score: 8.1 (high) Timeline Public Disclosure Date: 2026-08-19 Add Date: 2026-08-19 Last Updated: 2026-08-20 References Original Researcher: Jakub Herman Submitter: Jakub Herman Submitter Website: https://jakubherman.net Verification Status: Yes WPVDB ID: fb59519b-80ae-48e4-a31a-71d24ded205b Other Related Vulnerabilities Inperstion For Theme <= 1.0 - Authenticated (Contributor+) Arbitrary Function Call Active Products Tables for WooCommerce. Use constructor to create tables < 1.0.6.6 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smth WPTouch 1.9.8 - ajax/file_upload.php Crafted Content-Type File Upload Remote Code Execution Paid Videochat Turnkey Site < 7.3.24 - Admin+ Remote Code Execution Cart All In One For WooCommerce < 1.1.22 - Admin+ Code Injection POC Code No specific POC code is provided on the page; however, it states that the POC will be demonstrated on September 19, 2026, to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18781: Unauthenticated RCE via Filename Bypass in WP Plugin Drag and Drop Multiple File Upload

More from this source