The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to an unauthenticated limited file upload exploit that allows attackers to upload .phar or .svg files containing malicious PHP or JavaScript code. The vulnerability arises from improper file type validation, enabling the acceptance of dangerous file types with no restriction. This flaw permits attackers to place executable scripts on the server, potentially leading to remote code execution if the server is configured to execute .phar files, or to Stored Cross‑Site Scripting via .svg files under certain conditions. The flaw is classified as CWE‑434.

The issue affects all versions of the Drag and Drop Multiple File Upload for Contact Form 7 plug‑in (vendor glenwpcoder) up to and including 1.3.9.2. The plug‑in extends the core Contact Form 7 plugin, so any WordPress site running both components with a vulnerable plug‑in version is at risk. Site owners should verify the presence and version of the add‑on.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests low exploitation probability as of the latest data, and the vulnerability is not yet listed in CISA KEV. However, the presence of unfiltered .phar uploads can enable a remote code execution path if the host’s web server is configured to treat .phar files as PHP, a scenario that is common in misconfigured environments. Attackers can exploit this via the public faces of Contact Form 7 forms, so the attack vector is unauthenticated and remote.