CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
Explanation of Vulnerability in Simple Terms
A path traversal vulnerability in Drag and Drop Multiple File Upload Contact Form 7 allows authenticated administrators to read, modify, or delete files outside the intended upload directory. The vulnerability requires high-level privileges and affects a narrow version range. Low confidentiality, integrity, and availability impact.
What an attacker can do
Read, modify, or delete files on the server outside the upload directory.
Potential impact on your site
An admin account compromise could expose or alter sensitive files on your server.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
