PT-2026-2983 · WordPress · Drag/Drop Multiple File Upload – Contact Form 7

Angus Girvan · Publicado 2026-01-15 · Atualizado 2026-01-23 · CVE-2025-14457

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress versions up to and including 1.3.9.2

Description The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is susceptible to unauthorized modification of data. This is due to a missing ownership check within the dnd codedropz upload delete() function. This allows unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.

Recommendations Update to a version beyond 1.3.9.2.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14457

Produtos afetados

Drag/Drop Multiple File Upload – Contact Form 7

Referências · 7

• https://twitter.com/VulmonFeeds/status/2011748950827536619 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3428236/drag-and-drop-multiple-file-upload-contact-form-7 · Correção
• https://wordfence.com/threat-intel/vulnerabilities/id/1a182243-b24a-4c46-8b65-6b38d8509a51?source=cve · Nota
• https://osv.dev/vulnerability/CVE-2025-14457 · Aviso do Fabricante
• https://t.me/cveNotify/149692 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2011759586861015343 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14457 · Nota de Segurança