Arbitrary File Upload Vulnerability in Drag and Drop Multiple File Upload Plugin for WordPress
CVE-2023-5822
9.8CRITICAL
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 22 November 2023
What is CVE-2023-5822?
The Drag and Drop Multiple File Upload plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation in the 'dnd_upload_cf7_upload' function. This vulnerability allows unauthenticated attackers to exploit sites using the plugin in versions up to and including 1.3.7.3. If a user with editing privileges adds a 'multiple file upload' field that accepts all file types ('*'), it opens up the possibility for remote code execution, compromising site integrity and user security.
Affected Version(s)
Drag and Drop Multiple File Upload – Contact Form 7 * <= 1.3.7.3