Arbitrary File Upload Vulnerability in WooCommerce Drag and Drop Multiple File Upload Plugin

CVE-2025-5746

What is CVE-2025-5746?

The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress exhibits a significant security flaw due to inadequate file type validation in the dnd_upload_cf7_upload_chunks() function. This vulnerability affects version 5.0 - 5.0.5 when used with the PrintSpace theme, as well as all versions up to and including 1.7.1 in its standalone form. The flaw allows unauthenticated attackers to upload arbitrary files onto the web server, potentially leading to remote code execution. While PHP execution may be restricted via a .htaccess file, certain server configurations could still permit this execution, heightening the risk for users.

References