WordPress plugin
Drag and Drop Multiple File Upload for Contact Form 7 security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High10
- Medium7
- Low1
All Drag and Drop Multiple File Upload for Contact Form 7 vulnerabilities
- Critical9.8Unauthenticated Remote Code Execution
<1.3.9.9Update to 1.3.9.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
<1.3.9.9Update to 1.3.9.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings
≤1.3.9.7Update to 1.3.9.8
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.3.9.7Update to 1.3.9.8
- High8.1Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
≤1.3.9.7Update to 1.3.9.8
- High7.5Unauthenticated Limited Arbitrary File Read via mfile Field
≤1.3.9.6Update to 1.3.9.7
- High8.1Unauthenticated Arbitrary File Upload
≤1.3.9.5Update to 1.3.9.6
- Low3.7Missing Authorization to Unauthenticated File Deletion
≤1.3.9.2Update to 1.3.9.3
- Medium6.1Unauthenticated Limited Arbitrary File Upload
≤1.3.9.2Update to 1.3.9.3
- Medium5.3Directory Traversal via `wpcf7_guest_user_id` Cookie
≤1.3.9.0Update to 1.3.9.1
- High8.1Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
≤1.3.8.9Update to 1.3.9.0
- High8.8Unauthenticated Arbitrary File Deletion
≤1.3.8.7Update to 1.3.8.8
- High7.5Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion
≤1.3.8.8Update to 1.3.8.9
- Medium5.3Limited Arbitrary File Deletion
≤1.3.8.5Update to 1.3.8.6
- Medium5.3Sensitive Information Exposure
≤1.3.7.7Update to 1.3.7.8
- High8.1Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload
≤1.3.7.3Update to 1.3.7.4
- High8.8Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete
≤1.3.6.5Update to 1.3.6.6
- Medium5.3File Upload Size Limit Bypass
≤1.3.6.4Update to 1.3.6.5
- High7.2Contact Form 7 <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting
≤1.3.6.2Update to 1.3.6.3
- Critical9.8Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload
≤1.3.3.2Update to 1.3.3.3
Drag and Drop Multiple File Upload for Contact Form 7: common questions
Does Drag and Drop Multiple File Upload for Contact Form 7 have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in Drag and Drop Multiple File Upload for Contact Form 7: 2 critical, 10 high, 7 medium, 1 low. None are known to affect version null.
How do I check which version of Drag and Drop Multiple File Upload for Contact Form 7 I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Drag and Drop Multiple File Upload for Contact Form 7 vulnerability?
CVE-2026-18781, published Aug 24, 2026: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated Remote Code Execution. Severity: Critical (CVSS 9.8).
Is any Drag and Drop Multiple File Upload for Contact Form 7 vulnerability listed in CISA KEV?
No. None of the known Drag and Drop Multiple File Upload for Contact Form 7 vulnerabilities is currently listed in the CISA KEV catalog.