CVE-2026-18781CWE-94code-injection

CVE-2026-18781

High · published August 21, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00543 · 44.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-21T11:16Z
References (1)
https://wpscan.com/vulnerability/fb59519b-80ae-48e4-a31a-71d24ded205b/ · [email protected]
EPSS history
Timeline
  • 21 AUG 06:00Z
    Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
    cvelistv5