CVE-2026-18781

creationtimestamp| type| source ---|---|--- 2026-08-21 07:30:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtlai4n7vj2t 2026-08-31 14:00:05+00:00| seen| https://t.me/DBXTERSLEARNING/1223 2026-09-01 00:00:09+00:00| published-proof-of-concept| https://t.me/DBXTERSLEARNING/1223...

CVE-2026-18781 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9 ) is vulnerable to unauthenticated Remote Code Execution (RCE) . The root cause is a failure to validate the final name of an uploaded file after stripping characters from it, which allows attacker...