Get real-time updates on Telegram
CVE-2026-18781: Drag and Drop Multiple File Upload for Contact Form 7 0 to before 1.3.9.9
CVE-2026-18781. CVSS 3.1 base score 8.1 (HIGH, Source advisory). EPSS 0.00543 (percentile 0.44417), scored 17-Oct-2026.
Affected technology
Drag and Drop Multiple File Upload for Contact Form 7 · 0 to before 1.3.9.9
Vendor not specified by the source
Description’s affected range: before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
The source says the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server. Source advisory’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-94
- CCR priority
- 32.5 /100 (P4)
- CVSS 3.1
- 8.1 /10 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · Source advisory
- EPSS
- 0.00543 · percentile 0.44417 · 2026-10-17
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-18 20:23:06.032219+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-18781.html