File upload add-ons for Contact Form 7 receive untrusted files from anonymous website visitors, write them into the WordPress uploads directory, and expose AJAX endpoints for uploading and deleting those files. Drag and Drop Multiple File Upload for Contact Form 7 version 1.4.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64695, confirming that the review focused on unauthenticated AJAX upload handling, file-extension and MIME validation, filename sanitization and anti-script renaming, upload-path confinement, token-based file-deletion authorization, request rate limiting, and output escaping in the settings screen.

Name of	Drag and Drop Multiple File Upload for Contact Form 7
Version	1.4.0
Active installations	60,000+
Description	Adds a drag-and-drop multiple file upload field to Contact Form 7 forms, with an AJAX uploader, file type and size validation, per-field file-count limits, and optional randomized filenames.
Security	Successfully tested for: SQL Injection (SQLi) Cross-Site Scripting (XSS) – Stored and Reflected Cross-Site Request Forgery (CSRF) Authentication Vulnerabilities Authentication Bypass Exploits Privilege Escalation Buffer Overflow Denial-of-Service (DoS) vectors Data Leakage Vulnerabilities Insecure Dependency Usage Remote Code Execution (RCE) Risks Unauthorized File Access Insufficient Injection Protection Information Disclosure via Misconfigured Endpoints
CleanTalk Certification	Proudly earned the “Plugin Security Certification” (PSC) from CleanTalk, indicating adherence to stringent security standards.
Additional Information	Use Drag and Drop Multiple File Upload for Contact Form 7 with confidence backed by the “Plugin Security Certification” (PSC). Keep upload fields restricted to the specific extensions you actually need (avoid the wildcard * type), leave automatic file deletion enabled, and make sure your web server refuses to execute scripts inside the uploads directory.
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Key Features

Drag and Drop Multiple File Upload for Contact Form 7 adds an [mfile] form-tag to Contact Form 7 so visitors can drag and drop, or browse for, several files at once. Files are uploaded asynchronously over admin-ajax.php, validated against the extensions and size limits configured for the field, stored in a dedicated per-submission folder under wp-content/uploads/wp_dndcf7_uploads/, and either attached to the notification email or delivered as links. Administrators can customize labels and error messages, cap the number and size of files per field, randomize stored filenames, and rely on an automatic cleanup task that removes old uploads.

Security Assurance

The CleanTalk Plugin Security Certification evaluation focused on the plugin’s unauthenticated file-handling surface: the dnd_codedropz_upload and dnd_codedropz_upload_delete AJAX actions, the extension blocklist and allow-list logic, filename canonicalization and anti-script renaming, confinement of writes to the plugin’s own uploads subfolder, and the token-based ownership check that guards file deletion. The review also considered request rate limiting, honeypot and dependency handling, information exposure through endpoints, and escaping of stored settings rendered on the front end and in the admin.

Extension-filter bypass attempts — direct script extensions (.php, .phtml, .pht, .phar, .php5, .phps), case variations (.PHP), trailing dots (.php.), double extensions (.php.jpg, .pht.png, .phtml.gif), reversed order (.jpg.php), separator tricks (.php;.jpg), null-byte injection (.php%00.jpg), and browser-executable types (.svg, .html, .htm, .xhtml, .htaccess) — were all either rejected or neutralized (dangerous middle extensions are rewritten to a safe form, e.g. a.php.jpg → a.php_.jpg). Files stored under permitted extensions are served as static content and are not executed, and the deletion endpoint could not be abused for path traversal or to remove files outside a caller’s own upload folder.

The plugin has been successfully tested for:

✅ Information Leakage Vulnerabilities

✅ SQL Injection Vulnerabilities

✅ Cross-Site Scripting (XSS) Attacks

✅ Cross-Site Request Forgery (CSRF) Attacks

✅ Authentication and Authentication Bypass Vulnerabilities

✅ Privilege Escalation Vulnerabilities

✅ Buffer Overflow Vulnerabilities

✅ Denial-of-Service (DoS) Vulnerabilities

✅ Data Leakage Vulnerabilities

✅ Insecure Dependencies

✅ Code Execution Vulnerabilities

✅ File Unauthorized Access Vulnerabilities

✅ Insufficient Injection Protection

Conclusion

With PSC-2026-64695, Drag and Drop Multiple File Upload for Contact Form 7 version 1.4.0 demonstrates strong baseline security for anonymous file-upload workflows. The certification addresses upload authorization flow, extension and MIME validation, filename sanitization and anti-script renaming, upload-path confinement, token-based deletion ownership, and rate limiting. Classic file-upload risks associated with this category — unrestricted upload leading to remote code execution, stored cross-site scripting via uploaded markup, and arbitrary file deletion through path traversal — were tested and could not be reproduced in this version. Site owners should keep upload fields limited to required file types, retain automatic deletion of stored files, and ensure the web server denies script execution within the uploads directory.

Note: The date and certification information may change over time. It is advisable to verify the latest details on the plugin developer’s website.