The flaw allows an unauthenticated attacker to upload arbitrary PHP files by manipulating the file type parameter before the extension is sanitized. The plugin validates the unsanitized extension while saving the file with a sanitized filename; special characters such as a dollar sign are stripped during the save process, enabling the upload of executable PHP code. Successful exploitation can lead to remote code execution, although the plugin includes an .htaccess rule and randomly generated filenames that diminish real‑world attack effectiveness.

WordPress sites that use the Drag and Drop File Upload for Contact Form 7 plugin version 1.1.3 or earlier. The plugin is provided by addonsorg and commonly integrated with the Contact Form 7 ecosystem, affecting any standard WordPress installation that has the plugin installed.

The CVSS score of 8.1 highlights the high severity, while the EPSS score of less than 1% indicates a very low probability of widespread exploitation; the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the lack of authentication requirements and the public upload endpoint mean that any exposed WordPress site could be used by an attacker to try to upload malicious PHP files, potentially achieving remote code execution if the server permits PHP execution in the upload directory. The .htaccess restrictions and filename randomization mitigate but do not eliminate this threat.