Drag and Drop Multiple File Upload CF7 CVE-2026-14325

Exploitation requires an authenticated WordPress administrator account - the CVSS vector PR:H confirms high-privilege authentication is mandatory. The attacker must have write access to the plugin's admin settings panel. The victim (a site visitor) must load a front-end page that renders the plugin's upload field; user interaction is required per UI:R in the CVSS vector. The vulnerability is limited to WordPress installations running the Drag and Drop Multiple File Upload for Contact Form 7 plugin at versions below 1.3.9.9. There is no unauthenticated exploitation path. Non-default conditions include having the plugin installed and active, and the upload field present on at least one published page.

The CVSS 3.5 base score reflects the high-privilege prerequisite (PR:H) and required user interaction (UI:R), which substantially limits the attack surface - exploitation requires an authenticated WordPress administrator to first set the malicious payload via the plugin's admin panel. EPSS data is not available in the provided input. No KEV listing is present, indicating no confirmed active exploitation at time of analysis. A publicly available exploit (via WPScan) elevates real-world risk modestly, as it lowers the bar for abuse. The practical risk is highest in multi-administrator or compromised-admin scenarios: an attacker who gains admin credentials (via credential stuffing, phishing, or another vulnerability) could weaponize this to persistently target all site visitors. For single-admin self-hosted sites, the incremental risk is low. This is a real but lower-priority finding unless admin account compromise is a realistic threat model.

An attacker who has obtained WordPress administrator credentials - through phishing, credential reuse, or a separate authentication bypass - navigates to the Drag and Drop Multiple File Upload plugin settings and enters a crafted string as the HTML tag name field. Upon saving, any front-end page rendering the plugin's upload widget will include the attacker's payload in the page DOM, executing arbitrary JavaScript in every visiting user's browser. A publicly available exploit for this technique exists via WPScan.