The Drag and Drop Multiple File Upload for Contact Form 7 plugin allows an unauthenticated attacker to supply arbitrary file paths to the dnd_remove_uploaded_files function, resulting in deletion of files such as wp-config.php. The vulnerability stems from insufficient file path validation, a classic directory traversal flaw (CWE-22). When an administrator deletes a message, the attacker can delete critical system files, enabling possible remote code execution and significant compromise of confidentiality, integrity, and availability.

Affected systems are installations of the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress, versions up to and including 1.3.8.7. The flaw is only exploitable when the Flamingo plugin is installed and activated, which is required for handling uploaded messages.

The CVSS score of 8.8 classifies this as a high severity flaw, and the EPSS of 4% indicates a moderate probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers do not need authentication; they only need the ability to trigger the upload deletion endpoint, which can be done via crafted HTTP requests. Failure to address the flaw may allow attackers to delete arbitrary files on the web server, leading to potential remote code execution through subsequent exploitation pathways.