The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress permits file uploads through its drag‑and‑drop interface. The vulnerability stems from insufficient file type validation when users configure custom blacklist types; the plugin replaces the default dangerous extension denylist instead of merging with it. Additionally, the filename sanitization function wpcf7_antiscript_file_name() can be bypassed for filenames containing non‑ASCII characters. An unauthenticated attacker can exploit these weaknesses to upload arbitrary files – including PHP scripts – to the server, which can then be executed to gain remote code execution. The flaw was first reported by Leonid Semenenko and a partial patch was released in version 1.3.9.7, but a workaround for that patch was later discovered by Nguyen Hung, allowing continued exploitation in affected releases.

Any WordPress installation using the Drag and Drop Multiple File Upload for Contact Form 7 plugin, version 1.3.9.6 or earlier. The plugin is distributed by glenwpcoder. No specific WordPress core or other plugin versions are required to be at any particular setting for the flaw to be exploitable.

The recorded CVSS score is 8.1, indicating high severity. The EPSS score is 4%, and the vulnerability is not listed in CISA’s KEV catalog. An unauthenticated attacker can trigger the flaw simply by submitting a file upload request with a non‑ASCII filename that passes the overridden blacklist. Because the upload reaches the server without authentication and the uploaded file can be placed in an executable directory, the exploitation path is straightforward and does not require additional privileges.