The Drag and Drop Multiple File Upload (Pro) – WooCommerce plugin allows unauthenticated users to upload files without proper content‑type validation. This flaw, located in the dnd_upload_cf7_upload_chunks() function, permits an attacker to place arbitrary files on the web server. Because PHP execution is disabled by a default .htaccess rule, exploitation only succeeds in configurations that allow PHP to run in the upload directory. Nonetheless, the possibility of uploading and executing a malicious script represents a high‑impact vulnerability that can compromise confidentiality, integrity, and availability.

Affected versions are the standalone plugin from 1.0 through 1.7.1 and the bundled 5.0 to 5.0.5 releases that ship with the PrintSpace theme. All installations of these versions running on WordPress are vulnerable unless the plugin is updated or removed.

The CVSS score of 9.8 classifies it as critical, and the EPSS score of 2% indicates that, while exploitation is not widespread, it remains a non‑zero risk. The vulnerability is not listed in the CISA KEV catalog, but its unauthenticated nature and potential for remote code execution make it a priority target for attackers. An attacker can trigger the flaw by sending a crafted file upload request to the plugin’s upload endpoint, bypassing any authentication or CSRF checks.