CVE-2025-53283 CRITICAL

CVE-2025-53283: WordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin <= 2.4.1 - Arbitrary File Upload Vulnerability

Vendor Borisolhor
Product Drop Uploader for CF7 - Drag&Drop File Uploader Addon
Weakness CWE-434 · Unrestricted file upload
Published November 6, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through <= 2.4.1.

Explanation of Vulnerability in Simple Terms

02Summary

Drop Uploader for CF7 versions up to 2.4.1 do not properly validate uploaded files, allowing anyone to upload malicious files to the site without authentication. An attacker can upload executable code, scripts, or other dangerous files that execute on the server or are served to visitors. This vulnerability affects the entire site and can lead to complete compromise.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files on the site without needing a login or user account.

Potential impact on your site

04Site Impact

Attackers can upload web shells, malware, or scripts that run on your server or infect visitors.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 6, 2025 CVE published
April 28, 2026 Record updated