Unrestricted File Upload Vulnerability in Borizolhor Drop Uploader for Contact Form 7
CVE-2025-53283

10CRITICAL

Key Information:

Vendor

WordPress
Status
Drop Uploader For Cf7 - Drag&drop File Uploader Addon
Vendor
CVE Published:
6 November 2025

What is CVE-2025-53283?

The Borizolhor Drop Uploader for Contact Form 7 contains a vulnerability that allows an attacker to upload files of dangerous types, such as web shells, to the web server. This issue affects versions of the plugin up to and including 2.4.1, potentially leading to serious security breaches by enabling unauthorized access and control over the server.

Affected Version(s)

Drop Uploader for CF7 - Drag&Drop File Uploader Addon 0 <= 2.4.1

References

https://patchstack.com/database/Wordpress/Plugin/drop-upl...
vdb-entry

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xd4rk5id3 | Patchstack Bug Bounty Program
.