CVE-2026-3459 - Vulnerability Analysis

Overview

Drag and Drop Multiple File Upload - Contact Form 7 WordPress plugin <= 1.3.7.3 contains an unrestricted file upload vulnerability caused by insufficient file type validation in 'dnd_upload_cf7_upload' function, letting unauthenticated attackers upload arbitrary files, exploit requires a form with multiple file upload field accepting '*' file type.

Severity & Score

Impact

Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.

Mitigation

Update to the latest version of the plugin.

References

• https://plugins.trac.wordpress.org/changeset/3475121/drag-and-drop-multiple-file-upload-contact-form-7
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3205670c-5c3c-48c3-a34a-6f9c25668258?source=cve
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.5/inc/dnd-upload-cf7.php#L1146
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.5/inc/dnd-upload-cf7.php#L886

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 5, 2026

🟠 CVE-2026-3459 - High (8.1) The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This m... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3459/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner