Arbitrary File Deletion Vulnerability in Drag and Drop Multiple File Upload Plugin for WordPress
CVE-2025-2328

8.8HIGH

Key Information:

Vendor
WordPress
Status
Drag And Drop Multiple File Upload For Contact Form 7
Vendor
CVE Published:
28 March 2025

Summary

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress has a serious security flaw that allows unauthorized attackers to delete files from the server due to inadequate validation of file paths in its 'dnd_remove_uploaded_files' function. All versions up to and including 1.3.8.7 are affected. This vulnerability can be exploited if the Flamingo plugin is installed and activated, enabling attackers to manipulate uploaded files and potentially gain remote code execution by tricking an administrator into deleting certain messages.

Affected Version(s)

Drag and Drop Multiple File Upload for Contact Form 7 * <= 1.3.8.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/drag-and-drop-...
https://plugins.trac.wordpress.org/changeset/3261964/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Tan Phat
.