The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7_guest_user_id cookie. This vulnerability allows unauthenticated attackers to upload and delete files outside of the intended directory. Although the impact is limited due to file type validation, it poses a risk as deletion is restricted to the plugin’s uploads folder.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-8464 |
Exploitation
To exploit this vulnerability, an attacker can manipulate the wpcf7_guest_user_id cookie to perform directory traversal attacks, allowing them to upload or delete files outside the designated upload directory. This can be done without authentication, making it accessible to any user who can send requests to the affected plugin.
Affected Products
- Drag and Drop Multiple File Upload for Contact Form 7: A WordPress plugin that allows users to upload multiple files through a contact form, vulnerable to directory traversal attacks.
Mitigation
To mitigate this vulnerability, it is recommended to update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to the latest version. Additionally, implementing strict file type validation and access controls can help prevent unauthorized file uploads and deletions.