Drag and Drop File Upload for Contact Form 7
Drag and Drop File Upload for Contact Form 7 has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 8.1, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 1 of the records (100%).
The one issue recorded for Drag and Drop File Upload for Contact Form 7 has a vendor fix available, so running the current release closes it.
All of these findings were reported by Thomas Sanzey. Drag and Drop File Upload for Contact Form 7 is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-5364Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass
Read the full analysisVulnerability Records
Drag and Drop File Upload for Contact Form 7
Author
add-ons.org
contact-form-7Drag and Drop File Upload for Contact Form 7 is the most advanced extension for CF7 that replaces the boring standard file upload field with a beautiful, high-performance Drag and Drop area. Built with modern AJAX technology, it allows your users to upload files in the background. No more form submission delays or timeouts for large files! Once the user drops a file, it starts uploading immediately, providing a smooth and professional user experience. Why Choose This Plugin? Modern AJAX Upload: Files upload instantly upon selection, reducing the chance of form submission errors by up to 80%. Multiple Files Supported: Give your users the freedom to upload one or dozens of files at once. Email Attachments: Automatically attach uploaded files to your Contact Form 7 emails without any extra configuration. SEO & Speed Optimized: Lightweight JS and CSS ensure your site stays fast while looking premium. Automatic Storage Management: Includes a smart auto-cleanup feature to delete temporary files daily, keeping your server storage lean. DEMO: View Live Demo DOCUMENTATION: Setup Guide PRO VERSION: Download Premium Features Sleek Drag & Drop Interface: Professional design that fits any theme. AJAX Progress Bar: Let users see the upload status in real-time. Multiple File Validation: Set a minimum and maximum number of files allowed. Custom File Types: Restrict uploads to specific extensions (e.g., PDF, JPG, ZIP, DOCX). File Size Limits: Set custom MB limits per field to protect your server. Image Previews: (Pro) Show beautiful thumbnails before the form is even sent. Mobile & Tablet Friendly: Fully optimized for touch devices and mobile browsers. Easy Tag Generator: Standard CF7 tag generator integration for [file_uploads] fields. Translation Ready: Fully compatible with WPML, Polylang, and Loco Translate. PRO VERSION FEATURES Unlock the full potential of your forms: – Instant Image Previews: Show thumbnails as soon as images are dropped. – Multiple Upload Areas: Use as many upload fields as you want on a single form. – Premium Support: Get help from our experts within 2 hours. – File Renaming: (Pro) Automatically rename files to avoid duplicates.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C