The Drag and Drop Multiple File Upload for Contact Form 7 plugin contains a directory traversal flaw that can be triggered by an attacker setting a crafted wpcf7_guest_user_id cookie. The vulnerability permits unauthenticated uploads of files whose resolved file paths lie outside the intended upload directory; however, only file types that the plugin deems safe are accepted. Deletion is restricted to the plugin’s uploads folder, so files cannot be removed from other locations on the server.

WordPress installations running Drag and Drop Multiple File Upload for Contact Form 7 version 1.3.9.0 or earlier, released by glenwpcoder. Any site that has the plugin enabled and accepts file uploads is potentially affected.

With a CVSS score of 5.3, the flaw is of moderate severity. An EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and no widespread exploits are confirmed. Attackers can trigger the issue without authentication, typically by accessing a file upload page or injecting the malicious cookie in a request. Though the deletion scope is limited to the uploads folder, the ability to place arbitrary files beyond the intended directory can expose the site to injected content that may be executed later, or to accidental removal of legitimate site assets. The overall risk remains moderate, with the primary impact being the potential for unexpected file placement and loss of upload‑directory content.