Directory Traversal Vulnerability in Drag and Drop Multiple File Upload for Contact Form 7 Plugin by WordPress

CVE-2025-8464

What is CVE-2025-8464?

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress contains a directory traversal vulnerability that allows unauthenticated attackers to leverage the wpcf7_guest_user_id cookie to upload and remove files outside the designated upload folder. Although the plugin implements file type validation and restricts deletions to its own upload directory, the potential for unauthorized file manipulation remains a concern. Users of the plugin should consider upgrading to the latest version to mitigate this risk.

References