CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.
Explanation of Vulnerability in Simple Terms
The Drag and Drop Multiple File Upload for Contact Form 7 plugin contains a vulnerability that allows attackers to modify data on the site without authentication. The flaw stems from improper input validation in file upload handling. No user interaction is required for exploitation. Site administrators should update to a version newer than 1.3.8.5.
What an attacker can do
Modify or corrupt data on the site through malicious file uploads.
Potential impact on your site
Attackers can alter site content or data without logging in, potentially affecting form submissions and uploaded files.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
