CVE-2025-2328: Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'dndremoveuploadedfiles' function in all versions up to, and including, 1.3.8.7. This makes it possible for unauthenticated attackers to add arbitrary file paths (such as ../../../../wp-config.php) to uploaded files on the server, which can easily lead to remote code execution when an Administrator deletes the message. Exploiting this vulnerability requires the Flamingo plugin to be installed and activated.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2328?
CVE-2025-2328 is a high-severity vulnerability that allows arbitrary file deletion due to insufficient file path validation.
How do I fix CVE-2025-2328?
To fix CVE-2025-2328, update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.8.8 or later.
Who is affected by CVE-2025-2328?
CVE-2025-2328 affects all versions of the Drag and Drop Multiple File Upload for Contact Form 7 plugin up to and including version 1.3.8.7.
What causes the vulnerability in CVE-2025-2328?
The vulnerability in CVE-2025-2328 is caused by insufficient file path validation in the 'dnd_remove_uploaded_files' function.
What impact does CVE-2025-2328 have on my WordPress site?
CVE-2025-2328 can potentially lead to unauthorized file deletions, compromising the integrity of your WordPress site.