CVE-2025-14842
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files, allowing unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can achieve remote code execution via direct file access if the server executes .phar as PHP, and .svg uploads allow Stored XSS under certain circumstances.
Risk Assessment
Remote code execution may allow an attacker to fully compromise the server, and stored XSS can lead to session theft. The risk is critical as the attack requires no authentication and can be performed remotely.
Recommendation
Immediately update the plugin to a version later than 1.3.9.2 or disable it. It is also recommended to configure the server not to execute .phar files as PHP and implement file upload validation.
Other vulnerabilities in Drag and Drop Multiple File Upload – Contact Form 7
Original NVD description (English source)
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can be used to achieve remote code execution on the server via direct file access, if the server is configured to execute .phar files as PHP. The upload of .svg files allows for Stored Cross-Site Scripting under certain circumstances.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS