CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
Explanation of Vulnerability in Simple Terms
The Drag and Drop Multiple File Upload for Contact Form 7 plugin contains an information disclosure vulnerability in versions up to 1.3.7.7. An unauthenticated attacker can read sensitive data through the plugin without requiring user interaction. The vulnerability stems from improper access controls on file upload functionality. Site administrators should update to a version newer than 1.3.7.7.
What an attacker can do
Read sensitive information from the site without authentication.
Potential impact on your site
Sensitive data may be exposed to unauthenticated visitors through the file upload feature.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
