Arbitrary File Upload Vulnerability in Drag and Drop Multiple File Upload for Contact Form 7 by WordPress
CVE-2025-3515
What is CVE-2025-3515?
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is susceptible to an arbitrary file upload flaw due to inadequate file type validation. This vulnerability affects all versions up to and including 1.3.8.9, allowing unauthenticated attackers to evade the plugin's security measures. As a result, they can upload malicious file types, such as .phar, to the server. This situation poses a significant risk for remote code execution, particularly on systems where .phar files are processed as executable PHP scripts, especially under default Apache+mod_php configurations that do not enforce strict validation.
Affected Version(s)
Drag and Drop Multiple File Upload for Contact Form 7 * <= 1.3.8.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved