PT-2026-2983 · WordPress · Drag/Drop Multiple File Upload – Contact Form 7

Angus Girvan · Published 2026-01-15 · Updated 2026-01-23 · CVE-2025-14457

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress versions up to and including 1.3.9.2

Description The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is susceptible to unauthorized modification of data. This is due to a missing ownership check within the dnd codedropz upload delete() function. This allows unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.

Recommendations Update to a version beyond 1.3.9.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14457

Affected Products

Drag/Drop Multiple File Upload – Contact Form 7

References · 7

• https://plugins.trac.wordpress.org/changeset/3428236/drag-and-drop-multiple-file-upload-contact-form-7 · Patch
• https://osv.dev/vulnerability/CVE-2025-14457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14457 · Security Note
• https://twitter.com/VulmonFeeds/status/2011748950827536619 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1a182243-b24a-4c46-8b65-6b38d8509a51?source=cve · Note
• https://t.me/cveNotify/149692 · Telegram Post
• https://twitter.com/CVEnew/status/2011759586861015343 · Twitter Post