The vulnerability stems from the plugin’s failure to properly validate the final file name after removing characters, allowing an unauthenticated attacker to upload a file with a malicious filename that bypasses the file type restrictions. The attacker can then execute arbitrary code on the server, giving full control over the affected WordPress installation.

Any WordPress site running Drag and Drop Multiple File Upload for Contact Form 7 before version 1.3.9.9 is affected. The plugin, which is intended to allow convenient file uploads for contact forms, is therefore a critical point of exposure on all sites that have not yet upgraded.

The vulnerability is exploitable by anyone who can visit the site and submit a file form; no authentication is required. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the impact is severe. An attacker could upload code and gain full remote execution, and because the flaw is present in the file upload component it can be triggered without further privileges. The lack of a publicly known exploit does not reduce the risk; the straightforward nature of the upload pathway means a skilled adversary could create a simple exploit readily.