CVE-2023-5822: Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnduploadcf7upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if a user authorized to edit form, which means editor privileges or above, has added a 'multiple file upload' form field with '' acceptable file types.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-5822?
CVE-2023-5822 is a vulnerability found in the Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress.
What is the severity of CVE-2023-5822?
CVE-2023-5822 has a severity rating of critical with a score of 9.8.
How does CVE-2023-5822 impact WordPress and the plugin?
CVE-2023-5822 allows unauthenticated attackers to upload arbitrary files to the affected plugin, potentially compromising the WordPress installation.
What is the affected version of the Drag and Drop Multiple File Upload - Contact Form 7 plugin?
Versions up to and including 1.3.7.3 of the Drag and Drop Multiple File Upload - Contact Form 7 plugin are affected by CVE-2023-5822.
How can I fix CVE-2023-5822?
Currently, there is no official fix available for CVE-2023-5822. It is recommended to update to the latest version of the plugin once a fix is released.