Arbitrary File Upload Vulnerability in Drag and Drop Multiple File Upload for Contact Form 7 by WordPress

CVE-2025-3515

What is CVE-2025-3515?

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is susceptible to an arbitrary file upload flaw due to inadequate file type validation. This vulnerability affects all versions up to and including 1.3.8.9, allowing unauthenticated attackers to evade the plugin's security measures. As a result, they can upload malicious file types, such as .phar, to the server. This situation poses a significant risk for remote code execution, particularly on systems where .phar files are processed as executable PHP scripts, especially under default Apache+mod_php configurations that do not enforce strict validation.

References