The Drag and Drop Multiple File Upload for Contact Form 7 plugin can deserialize untrusted input from the “dnd_upload_cf7_upload” function, allowing an attacker to craft a malformed PHAR file that injects a PHP object. This PHP Object Injection does not contain a built‑in Payload‑Oriented Programming (POP) chain, so the vulnerability alone cannot delete files or run code; however, if another plugin or theme on the host contains a compatible POP chain, the attacker could delete arbitrary files, read sensitive data, or execute arbitrary code. The flaw is exploitable by unauthenticated users who can submit a form that includes a file upload field, and it requires the Flamingo plugin to be installed and activated.

All WordPress sites that use the Drag and Drop Multiple File Upload for Contact Form 7 plugin by glenwpcoder and have a version up to and including 1.3.8.7 are affected. A partial patch was added in 1.3.8.8, but the vulnerability remains until a full fix mitigates the PHAR deserialization path.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of 2% reflects a realistic probability that the flaw may be attempted in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw from anywhere over the network as soon as a form with an upload handler is publicly accessible; however, the actual impact hinges on the presence of a compatible POP chain in another plugin or theme and on the Flamingo plugin being active. In the absence of these prerequisites, the risk is substantially lower, though the flaw still poses a high threat to non‑patched sites that use the affected plugin in conjunction with vulnerable third‑party components.