The Drag and Drop Multiple File Upload plugin for Contact Form 7 contains insufficient file type validation in a core upload function. Unauthenticated users can supply any file type, causing the server to store the file without restrictions. This allows attackers to upload potentially executable content, creating a path for remote code execution if the uploaded file can later be accessed and executed by the web server. The vulnerability is classified under CWE‑434, highlighting missing validation of file type and extension.

Vendors: glenwpcoder. Product: Drag and Drop Multiple File Upload for Contact Form 7. Affected versions include all releases up to and including 1.3.7.3. WordPress sites running any of these versions are susceptible.

The CVSS base score of 8.1 denotes a high severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of this analysis. Although the vulnerability is not present in the CISA KEV catalog, its potential for remote code execution warrants attention. Exploitation requires an attacker to submit a form with a multiple file upload field that accepts a wildcard file type; no authentication or elevated permissions are needed. Once the malicious file is stored on the server, an attacker may execute it if the web server permits execution of the uploaded content.