Drag And Drop Multiple File Upload For Contact Form 7
Monthly
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Remote code execution in Drag and Drop Multiple File Upload for Contact Form 7 plugin (WordPress) versions ≤1.3.9.6 allows unauthenticated attackers to upload PHP webshells via dual file validation weaknesses. The plugin's custom blacklist configuration overwrites default protections instead of merging, and non-ASCII filenames bypass the wpcf7_antiscript_file_name() sanitizer. CVSS 8.1 with High attack complexity (AV:N/AC:H/PR:N/UI:N). Wordfence reported; patch released in changeset 3508522. No KEV listing or confirmed public exploitation, but proof-of-concept feasible given detailed vulnerable code references (lines 62, 883, 970, 987).
Path traversal in Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions ≤1.3.9.6) allows unauthenticated remote attackers to read arbitrary files within wp-content/ directory and exfiltrate them via email attachments. The plugin accepts client-supplied mfile[] POST parameters without server-side validation, directly converting user-controlled filenames to filesystem paths. CVSS 7.5 (High) reflects network attack vector with no authentication required. SSVC marks this as automatable with partial technical impact. No active exploitation confirmed (SSVC: exploitation=none), but the attack complexity is low and requires no user interaction, making this a realistic pre-authentication data exposure risk for sites using this plugin.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Stored Cross-Site Scripting in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (all versions through 1.3.9.7) allows authenticated administrators to persist malicious JavaScript via the 'drag_n_drop_text' and 'drag_n_drop_browse_text' plugin settings fields, which subsequently execute in the browsers of any site visitor accessing a page containing an affected CF7 upload form. The CVSS Scope:Changed designation reflects this cross-user impact - a compromised or rogue admin can silently weaponize public-facing forms without further interaction. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS score of 4.4 reflects the high privilege and high complexity prerequisites that substantially limit opportunistic exploitation.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Remote code execution in Drag and Drop Multiple File Upload for Contact Form 7 plugin (WordPress) versions ≤1.3.9.6 allows unauthenticated attackers to upload PHP webshells via dual file validation weaknesses. The plugin's custom blacklist configuration overwrites default protections instead of merging, and non-ASCII filenames bypass the wpcf7_antiscript_file_name() sanitizer. CVSS 8.1 with High attack complexity (AV:N/AC:H/PR:N/UI:N). Wordfence reported; patch released in changeset 3508522. No KEV listing or confirmed public exploitation, but proof-of-concept feasible given detailed vulnerable code references (lines 62, 883, 970, 987).
Path traversal in Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions ≤1.3.9.6) allows unauthenticated remote attackers to read arbitrary files within wp-content/ directory and exfiltrate them via email attachments. The plugin accepts client-supplied mfile[] POST parameters without server-side validation, directly converting user-controlled filenames to filesystem paths. CVSS 7.5 (High) reflects network attack vector with no authentication required. SSVC marks this as automatable with partial technical impact. No active exploitation confirmed (SSVC: exploitation=none), but the attack complexity is low and requires no user interaction, making this a realistic pre-authentication data exposure risk for sites using this plugin.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Stored Cross-Site Scripting in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (all versions through 1.3.9.7) allows authenticated administrators to persist malicious JavaScript via the 'drag_n_drop_text' and 'drag_n_drop_browse_text' plugin settings fields, which subsequently execute in the browsers of any site visitor accessing a page containing an affected CF7 upload form. The CVSS Scope:Changed designation reflects this cross-user impact - a compromised or rogue admin can silently weaponize public-facing forms without further interaction. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS score of 4.4 reflects the high privilege and high complexity prerequisites that substantially limit opportunistic exploitation.