The vulnerability resides in the Drag and Drop Multiple File Upload for Contact Form 7 plugin and permits an attacker to craft a malicious wpcf7_guest_user_id cookie, enabling directory traversal. Affected administrators can upload files that resolve to path locations outside the designated upload directory and can delete files within that folder, though only supported MIME types are allowed on upload. The attack does not grant full system compromise, but it could lead to the insertion of malicious content that might be executed if later viewed or may facilitate removal of legitimate files.

WordPress sites using the Drag and Drop Multiple File Upload for Contact Form 7 plugin, version 1.3.9.0 and earlier. The vulnerability affects all releases up to and including 1.3.9.0, as published by the plugin author glenwpcoder.

With a CVSS score of 5.3, the vulnerability is considered moderate severity. The EPSS score of 1% indicates low but non‑zero exploitation probability. Since the issue is not listed in the CISA KEV catalog, no widespread zero‑day exploits have been reported. Attackers who set a crafted wpcf7_guest_user_id cookie can trigger the vulnerability without authentication, typically by accessing a single upload page or embedding the cookie in a request. The impact is confined to files within the plugin's upload directory, but the ability to add arbitrary files could be leveraged for future phishing or malware delivery.