Read the docs
TI-2022-03032 Aliases CVE-2022-3282GHSA-m3g2-fxc2-5839

Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass

Priority MEDIUM 53CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.

Summary

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00676 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Drag and Drop Multiple File Upload – Contact Form 7 (Unknown): 1.3.6.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownDrag and Drop Multiple File Upload – Contact Form 71.3.6.5 to before 1.3.6.51.3.6.5Patch availableCNA
  • Drag and Drop Multiple File Upload – Contact Form 7 VendorUnknown Affected 1.3.6.5 to before 1.3.6.5 Fixed in 1.3.6.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:*:wordpress:*:*before 1.3.6.5Vulnerableglenwpcoder
  • cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:*:wordpress:*:* Versions before 1.3.6.5 Vulnerable ·glenwpcoder

Remediation

  • Fix · CNA Drag and Drop Multiple File Upload – Contact Form 7 (Unknown) Fixed in 1.3.6.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3282
  2. 2026-10-03 Alias added: GHSA-m3g2-fxc2-5839
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2020-10177 The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress… CVSS 3.1CRITICAL 9.8
  • TI-2023-01052 Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal CVSS 3.1CRITICAL 9.8
  • TI-2023-01210 Drag and Drop Multiple File Upload PRO - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2025-03087 Unrestricted file upload in glenwpcoder Drag and Drop Multiple File Upload for Contact… CVSS 3.1CRITICAL 9.8
  • TI-2023-05358 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2024-11378 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion CVSS 3.1CRITICAL 9.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences