← Back

CVE-2024-12267

nvd nist
Published: Jan 31, 2025Modified: Aug 11, 2025

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Exploitability: 3.9 / Impact: 5.2
Source: NVD

Description

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.

Affected (1)

Codedropz
1 product
Drag And Drop Multiple File Upload Contact Form 7
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Drag And Drop Multiple File Upload Contact Form 7
Before 1.3.8.6

Related CWEs

CWE-73
External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (2)

Source: security@wordfence.com
Patch
Source: security@wordfence.com
Third Party Advisory

Timeline

No history available yet.