CVE-2026-5710: 
WordPress vulnerability analysis and mitigation

CVE-2026-5710 is a Path Traversal vulnerability (CWE-22) in the "Drag and Drop Multiple File Upload for Contact Form 7" WordPress plugin that allows unauthenticated attackers to read arbitrary files via the mfile[] POST parameter. It affects all versions up to and including 1.3.9.6, developed by glenwpcoder. The vulnerability was disclosed on April 17, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 7.5 (High), assigned by Wordfence (Wordfence Advisory, GitHub Advisory).

The root cause is the plugin's use of client-supplied mfile[] POST values as the authoritative source for email attachment selection without any server-side upload provenance check, path canonicalization, or directory containment enforcement (CWE-22). In dnd_wpcf7_posted_data(), user-submitted filenames are directly appended to the plugin's upload URL without sanitization; in dnd_cf7_mail_components(), the URL is converted back to a filesystem path via str_replace(), and only file_exists() is used as a gate before attaching the file to the outgoing Contact Form 7 email. An attacker can inject path traversal sequences (e.g., ../../) into the mfile[] parameter to reference files outside the intended upload directory. The scope of exploitation is partially constrained by the wpcf7_is_file_path_in_content_dir() function in the Contact Form 7 plugin, which limits traversal to within the wp-content directory (Wordfence Advisory, Plugin Source L477).

Successful exploitation allows unauthenticated remote attackers to read and exfiltrate arbitrary files readable by the web server process within the wp-content directory, with the contents delivered as email attachments via the Contact Form 7 submission flow. Sensitive files potentially exposed include WordPress configuration fragments, plugin configuration files, database credentials, private keys, or other sensitive data stored under wp-content. There is no integrity or availability impact; the vulnerability is purely a confidentiality risk (Wordfence Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time (Wordfence Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker against a vulnerable installation. The EPSS score is approximately 0.14% (0.001410), indicating a low near-term exploitation probability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (Feedly).

1. Reconnaissance: Identify WordPress sites running the "Drag and Drop Multiple File Upload for Contact Form 7" plugin version ≤ 1.3.9.6 using tools like WPScan, Shodan, or by checking the plugin's readme.txt at /wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/readme.txt.
2. Locate a Contact Form 7 form: Find a page on the target site that uses a CF7 form with the drag-and-drop file upload field enabled, which is required to trigger the vulnerable code path.
3. Craft malicious POST request: Submit a form POST request to the CF7 form endpoint, injecting path traversal sequences into the mfile[] parameter. For example, set mfile[] to a value like ../uploads/../../plugins/some-plugin/config.php or another file within wp-content that contains sensitive data.
4. Trigger email attachment: The plugin's dnd_wpcf7_posted_data() function appends the attacker-controlled filename to the upload URL, and dnd_cf7_mail_components() converts it to a filesystem path and attaches the file to the outgoing CF7 notification email — provided file_exists() returns true and the path resolves within wp-content.
5. Receive exfiltrated file: The attacker-controlled or monitored email address (if specified in the form) receives the CF7 notification email with the targeted file attached, disclosing its contents (Wordfence Advisory, Plugin Source L203).

• Network: Unusual POST requests to CF7 form endpoints containing mfile[] parameter values with path traversal sequences (e.g., ../, ..%2F, URL-encoded variants) in web server access logs.
• Logs: WordPress or web server access logs showing repeated CF7 form submissions from the same IP with anomalous mfile[] values referencing files outside the plugin's upload directory; outbound SMTP activity triggered by form submissions with unexpected file attachments.
• File System: No direct file system artifacts are created by this attack, as it reads existing files rather than writing new ones.
• Email: Outgoing CF7 notification emails containing unexpected file attachments (e.g., PHP files, configuration files, or non-image files) that were not legitimately uploaded by a user (Wordfence Advisory).

Update the "Drag and Drop Multiple File Upload for Contact Form 7" plugin to a version newer than 1.3.9.6 immediately; the patch was released on April 17, 2026 (changeset 3508522) (Plugin Changeset). As a temporary workaround prior to patching, consider disabling the plugin or restricting file access permissions at the web server level to minimize the scope of files readable by the web server process within wp-content. Implement server-side input validation, path canonicalization, and strict directory containment boundary enforcement for any file upload mechanisms (Wordfence Advisory).

Wordfence disclosed the vulnerability and assigned the CVE on April 17, 2026, including it in their weekly WordPress vulnerability report for April 13–19, 2026 (Wordfence Blog). Sucuri also noted the vulnerability in their April 2026 vulnerability patch roundup (Sucuri Blog). RedPacket Security published a CVE alert and shared it on Mastodon, contributing to broader community awareness (RedPacket Security). General community reaction has been measured, consistent with the absence of active exploitation or public PoC code.