PT-2026-1566 · WordPress · Contact Form 7+1

Andrea Bocchetti · Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-14842

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress versions prior to 1.3.9.3

Description The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress allows the upload of potentially dangerous file types, specifically .phar and .svg files. This is due to the plugin failing to block these file extensions. Successful exploitation could allow unauthenticated attackers to upload malicious files. Uploading .phar files, if the server is configured to execute them as PHP, can lead to remote code execution. Uploading .svg files can result in Stored Cross-Site Scripting. The vulnerable parameters are the file upload functionality within the contact form.

Recommendations Update to version 1.3.9.3 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-14842

Affected Products

Contact Form 7

Drag/Drop Multiple File Upload – Contact Form 7

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14842 · Security Note
• https://plugins.trac.wordpress.org/browser/contact-form-7/trunk/includes/formatting.php#L310 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c78a0325-5bbf-4550-8477-94247f085e40?source=cve · Note
• https://twitter.com/CVEnew/status/2008795326514135043 · Twitter Post
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php#L1116 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3428236%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&old=3415946%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php#L108 · Note