CVE-2026-5718

The vulnerability in the Drag and Drop Multiple File Upload feature of the Contact Form 7 plugin for WordPress stems from inadequate validation of file types during uploads. This issue arises when custom blacklist types are configured, leading to a replacement of the default denylist for dangerous file extensions rather than merging it. Consequently, this flaw allows unauthenticated users to upload arbitrary files, including potentially malicious PHP scripts. Additionally, the sanitization function designed to handle filenames containing non-ASCII characters can be bypassed, further exacerbating the risk. This combination of factors creates a significant security gap, enabling attackers to exploit the system by uploading harmful files that could lead to remote code execution.

Attack vectors for this vulnerability are particularly concerning due to the ease with which an attacker can exploit it. An attacker could craft a malicious file with a non-ASCII filename and upload it through the compromised plugin. Once the file is successfully uploaded, the attacker can execute arbitrary code on the server, leading to full system compromise. This scenario is not limited to a single type of attack; it could facilitate various malicious activities, including data exfiltration, website defacement, or the establishment of persistent backdoors for future access. The lack of authentication required for file uploads significantly lowers the barrier for exploitation, making it a prime target for attackers seeking to compromise WordPress sites.

The real-world impact of this vulnerability is profound, particularly for businesses relying on WordPress for their online presence. A successful exploitation could lead to unauthorized access to sensitive data, loss of customer trust, and potential legal ramifications stemming from data breaches. The financial implications could be severe, ranging from the costs associated with incident response and remediation to potential fines for non-compliance with data protection regulations. Furthermore, the reputational damage inflicted on a business following such an incident can have long-lasting effects, deterring customers and partners alike.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating plugins and themes to their latest versions is crucial, as developers often release patches to address known vulnerabilities. Additionally, employing a web application firewall (WAF) can help filter out malicious traffic and prevent unauthorized file uploads. Monitoring logs for unusual activity, such as unexpected file uploads or changes to the file system, can also aid in early detection of exploitation attempts. Furthermore, organizations should consider implementing strict file type validation and employing security plugins that enhance the overall security posture of their WordPress installations.

In conclusion, the vulnerability within the Drag and Drop Multiple File Upload feature of the Contact Form 7 plugin poses a significant threat to WordPress sites. The combination of insufficient file type validation and the ability to bypass sanitization functions creates a pathway for attackers to execute arbitrary code on the server. The potential for real-world impact is substantial, with risks ranging from data breaches to reputational damage. By adopting robust detection and mitigation strategies, organizations can better protect themselves against this and similar vulnerabilities, ensuring the security and integrity of their web applications.

CSURFACE threat intelligence has detected a marked escalation in exploitation activity targeting CVE-2026-5718, coinciding with the emergence of multiple new public proof-of-concept exploits hosted on GitHub. This development has broadened the exploit landscape, making it more accessible for threat actors to weaponize the vulnerability. Our telemetry indicates a significant uptick in attempts to leverage this arbitrary file upload flaw, reflecting increased attacker interest and operationalization. The elevated EPSS score and the assignment of a high CVSS rating underscore the growing risk to WordPress environments utilizing the affected plugin versions. This shift amplifies the urgency for defenders to recognize the heightened threat level, as the availability of public exploit code lowers the barrier for exploitation and increases the likelihood of widespread compromise.

Update 2 — June 19, 2026

CSURFACE threat intelligence has detected a modest increase in exploitation attempts targeting CVE-2026-5718, accompanied by the emergence of new publicly available proof-of-concept exploits. While the overall exploit prediction scoring (EPSS) shows a slight downward adjustment, this does not diminish the operational relevance of the vulnerability given the broader exploit toolkit now accessible to threat actors. Our telemetry indicates that adversaries are diversifying their methods to bypass existing mitigations, leveraging the expanded exploit landscape to enhance attack success rates. This evolving activity underscores a persistent and adaptive threat posture that continues to place WordPress environments using the affected plugin versions at elevated risk. Defenders should note that despite a marginal decrease in EPSS, the qualitative increase in exploitation vectors and the availability of new exploit code collectively sustain a high-threat environment.