The Drag and Drop Multiple File Upload (Pro) – WooCommerce plugin allows unauthenticated users to upload files without proper content‑type validation. This flaw, located in the dnd_upload_cf7_upload_chunks() function, permits an attacker to place arbitrary files on the web server. Because PHP execution is disabled by a default .htaccess rule, exploitation only succeeds in configurations that allow PHP to run in the upload directory. Nonetheless, the possibility of uploading and executing a malicious script represents a high‑impact vulnerability that can compromise confidentiality, integrity, and availability.

CodeDropz’s Drag and Drop Multiple File Upload (Pro) – WooCommerce plugin from version 1.0 through 1.7.1 and the bundled 5.0 to 5.0.5 releases that ship with the PrintSpace theme are affected. All installations of these versions running on WordPress are vulnerable unless the plugin is updated or removed.

The CVSS score of 9.8 classifies it as critical, and the EPSS score of <1% indicates that exploitation is still unlikely but possible. The vulnerability is not listed in the CISA KEV catalog, but its unauthenticated nature and potential for remote code execution make it a priority target for attackers. An attacker can trigger the flaw by sending a crafted file upload request to the plugin’s upload endpoint, bypassing authentication.