CVE-2024-12267: Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dndcodedropzuploaddelete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12267?
CVE-2024-12267 is considered a moderate severity vulnerability due to its potential for arbitrary file deletion.
How do I fix CVE-2024-12267?
To fix CVE-2024-12267, update the Drag and Drop Multiple File Upload – Contact Form 7 plugin to the latest version beyond 1.3.8.5.
Who is affected by CVE-2024-12267?
CVE-2024-12267 affects all versions of the Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress up to and including version 1.3.8.5.
What types of attacks can CVE-2024-12267 enable?
CVE-2024-12267 can enable attackers to potentially delete arbitrary files on the server due to insufficient validation.
Is authentication required to exploit CVE-2024-12267?
CVE-2024-12267 can be exploited without authentication, making it particularly concerning for vulnerable installations.