Drag and Drop Multiple File Upload for Contact Form 7

drag-and-drop-multiple-file-upload-contact-form-7 · plugin

Known security vulnerabilities for Drag and Drop Multiple File Upload for Contact Form 7. Find out in seconds which version runs on your site with WP Lens.

20 known vulnerabilities

4 critical · 17 exploitable without logging in · 4 with public exploit code · latest Aug 21, 2026

Before you install

Use with care

12 records needing no login published in the last two years.

If you install it, keep auto-updates on and monitor the site: when a new record appears you need to update quickly.

This assessment relies only on published vulnerability records and wordpress.org data; it does not review the code.

Is this component installed on your sites, and in which version? See it from inside the site with Noroxi Connector

Listed on wordpress.org · latest 1.4.1 · last updated Oct 30, 2026 · 60K+ installs

wordpress.org status checked on Nov 4, 2026

Vulnerabilities

CVE-2025-3515unauthenticated≤ 1.3.8.9
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
Critical 9.8
CVE-2023-5822unauthenticated≤ 1.3.7.3
Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload
Critical 9.8
CVE-2020-12800unauthenticated
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code ex
Critical 9.8
CVE-2024-12267unauthenticated≤ 1.3.8.5
Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion
Critical 9.1
CVE-2025-2485unauthenticated · needs a click≤ 1.3.8.8
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion
High 8.8
CVE-2025-2328unauthenticated · needs a click≤ 1.3.8.7
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion
High 8.8
CVE-2022-45364unauthenticated · needs a click≤ 1.3.6.5
WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.6.5 is vulnerable to Cross Site Request Forgery (CSRF)
High 8.8
CVE-2026-18781unauthenticated→ 1.3.9.9
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
High 8.1
CVE-2026-5718unauthenticated≤ 1.3.9.7
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
High 8.1
CVE-2026-3459unauthenticated≤ 1.3.9.5
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload
High 8.1
CVE-2026-5710unauthenticated≤ 1.3.9.6
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field
High 7.5
CVE-2024-3717unauthenticated≤ 1.3.7.7
Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure
High 7.5
CVE-2025-14457unauthenticated≤ 1.3.9.2
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion
High 7.4
CVE-2026-49055unauthenticated · needs a click≤ 1.3.9.7
WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability
High 7.1
CVE-2025-14842unauthenticated · needs a click≤ 1.3.9.2
Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload
Medium 6.1
CVE-2022-0595unauthenticated · needs a click→ 1.3.6.3
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
Medium 5.4
CVE-2025-8464unauthenticated≤ 1.3.9.0
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie
Medium 5.3
CVE-2026-8991admin≤ 1.3.9.7
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n
Medium 4.4
CVE-2022-3282login required→ 1.3.6.5
Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass
Medium 4.3
CVE-2026-14325admin→ 1.3.9.9
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
Low 3.5

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory