TI-2024-11378 Aliases CVE-2024-12267 GHSA-wgmv-5488-h5p5

Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion

MEDIUM 45CWE-73Published 2025-01-31 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00336 27th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
glenwpcoder	Drag and Drop Multiple File Upload for Contact Form 7	up to 1.3.8.5	—	No fix listed	CNA

Drag and Drop Multiple File Upload for Contact Form 7 Vendorglenwpcoder Affected up to 1.3.8.5 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7::::::wordpress::*	before 1.3.8.6	Vulnerable	glenwpcoder

cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:*:wordpress:*:* Versions before 1.3.8.6 Vulnerable ·glenwpcoder

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-12267
2026-10-03 Alias added: GHSA-wgmv-5488-h5p5

References

Patch 1

https://plugins.trac.wordpress.org/changeset/3231973/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php

Advisory 1

https://www.wordfence.com/threat-intel/vulnerabilities/id/00ec7251-3be1-411a-b38e-1782d1691e18?source=cve

TI-2020-10177 The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress… CVSS 3.1CRITICAL 9.8
TI-2023-01052 Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal CVSS 3.1CRITICAL 9.8
TI-2023-01210 Drag and Drop Multiple File Upload PRO - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
TI-2022-03032 Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass CVSS 3.1MEDIUM 4.3
TI-2025-03087 Unrestricted file upload in glenwpcoder Drag and Drop Multiple File Upload for Contact… CVSS 3.1CRITICAL 9.8
TI-2023-05358 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences