What is CVE-2026-18781?

CVE-2026-18781 is a high-severity vulnerability in Drag And Drop Multiple File Upload For Contact Form 7, classified under Code Injection. CVSS score: 8.1/10. Published 2026-08-21.

How severe is CVE-2026-18781?

High severity. CVSS v3 base score is 8.1 out of 10.

RCE in Drag And Drop Multiple File Upload For Contact Form 7

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Unknown Drag And Drop Multiple File Upload For Contact Form 7

Weakness classification (CWE)

CWE-94 — Code Injection

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-18781?: CVE-2026-18781 is a high-severity vulnerability in Drag And Drop Multiple File Upload For Contact Form 7, classified under Code Injection. CVSS score: 8.1/10. Published 2026-08-21.
How severe is CVE-2026-18781?: High severity. CVSS v3 base score is 8.1 out of 10.