The Drag and Drop Multiple File Upload for Contact Form 7 plugin allows an attacker to supply a file path in the mfile[] POST parameter that is appended to an upload URL without any server‑side validation. The file name is later converted to a filesystem path, and the only check performed is file_exists(). If the path contains traversal sequences, the attacker can read any file that the web server process can access, and the contents will be sent back as an email attachment. This flaw results in unauthenticated arbitrary file read within the WordPress instance.

WordPress sites running the Drag and Drop Multiple File Upload for Contact Form 7 plugin, versions 1.3.9.6 and older. The vulnerability is confined to files within the wp‑content directory because the Contact Form 7 function wpcf7_is_file_path_in_content_dir() limits checks to that folder.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, so the contemporary likelihood of exploitation is unknown; however, the vulnerability is relatively easy to exploit – an unauthenticated attacker only needs to send a crafted POST request. The flaw is not listed in the CISA KEV catalog, but the combination of easy exploitation and potential data leakage warrants immediate attention. The attack path is inferred to be remote, via HTTP POST, and doesn't require any privileged access on the target site.