The vulnerable plugin enables users to upload files through a drag‑and‑drop interface. Insufficient validation occurs when custom blacklist types replace the default dangerous extension denylist, and the filename sanitization function is bypassed for non‑ASCII filenames. An attacker can upload an arbitrary file, such as a PHP script, to the server. If the file is executable, the attacker can achieve remote code execution on the host. This weakness is identified as CWE‑434.

Any WordPress installation using the Drag and Drop Multiple File Upload for Contact Form 7 plugin, version 1.3.9.6 or earlier. The plugin is distributed by glenwpcoder. No specific WordPress core or other plugin versions are required to be at any particular setting for the flaw to be exploitable.

The recorded CVSS score is 8.1, indicating high severity. The EPSS score is 3%, and the vulnerability is not listed in CISA’s KEV catalog. An unauthenticated attacker can trigger the flaw simply by submitting a file upload request with a non‑ASCII filename that passes the overridden blacklist. Because the upload reaches the server without authentication and the uploaded file can be placed in an executable directory, the exploitation path is straightforward and does not require additional privileges.