CVE-2025-14457

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14457", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T14:55:41.035Z", "datePublished": "2026-01-15T06:45:04.078Z", "dateUpdated": "2026-04-08T16:37:59.291Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:59.291Z"}, "affected": [{"vendor": "glenwpcoder", "product": "Drag and Drop Multiple File Upload for Contact Form 7", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.9.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the \"Send attachments as links\" setting is enabled."}], "title": "Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a182243-b24a-4c46-8b65-6b38d8509a51?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3428236/drag-and-drop-multiple-file-upload-contact-form-7"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.7, "baseSeverity": "LOW"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-12-10T15:12:01.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-14T18:17:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T14:47:34.011760Z", "id": "CVE-2025-14457", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T14:47:51.069Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14457", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T14:47:34.011760Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T14:47:42.600Z"}}], "cna": {"title": "Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "glenwpcoder", "product": "Drag and Drop Multiple File Upload for Contact Form 7", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.9.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-10T15:12:01.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-14T18:17:14.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a182243-b24a-4c46-8b65-6b38d8509a51?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3428236/drag-and-drop-multiple-file-upload-contact-form-7"}], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the \"Send attachments as links\" setting is enabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:59.291Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14457", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:59.291Z", "dateReserved": "2025-12-10T14:55:41.035Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-15T06:45:04.078Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Drag and Drop Multiple File Upload for Contact Form 7", "vendor": "glenwpcoder", "versions": [{"lessThanOrEqual": "1.3.9.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:codedropz:contact_form_7:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "A87B11D3-795F-4D07-8A35-54457518896C", "versionEndIncluding": "1.3.9.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the \"Send attachments as links\" setting is enabled."}, {"lang": "es", "value": "El plugin Drag and Drop Multiple File Upload para Contact Form 7 para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una falta de verificaci\u00f3n de propiedad en la funci\u00f3n dnd_codedropz_upload_delete() en todas las versiones hasta e incluyendo la 1.3.9.2. Esto hace posible que atacantes no autenticados eliminen archivos subidos arbitrarios cuando la configuraci\u00f3n 'Enviar archivos adjuntos como enlaces' est\u00e1 habilitada."}], "id": "CVE-2025-14457", "lastModified": "2026-06-17T08:35:57.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14457", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T14:47:34.011760Z", "version": "2.0.3"}}]}, "published": "2026-01-15T07:16:02.717", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3428236/drag-and-drop-multiple-file-upload-contact-form-7"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a182243-b24a-4c46-8b65-6b38d8509a51?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:41:27.700250+00:00", "value": {"mitigation_remediation": ["Upgrade Drag and Drop Multiple File Upload for Contact Form 7 to a version newer than 1.3.9.2", "If an upgrade cannot be performed immediately, disable the \"Send attachments as links\" setting or remove the plugin from the WordPress installation to prevent unauthenticated delete attempts", "Implement server\u2011side file access controls or custom logic to enforce ownership checks before allowing file deletion"], "summary": {"action": "Upgrade Plugin", "impact": "Data Deletion / Integrity"}, "threat_synthesis": {"affected_systems": "Versions of the plugin up to and including 1.3.9.2, distributed through WordPress, are affected. The vulnerable component is the dnd_codedropz_upload_delete() function, part of the Drag and Drop Multiple File Upload for Contact Form 7 plugin authored by glenwpcoder. Any WordPress installation that has this plugin installed and the \"Send attachments as links\" option enabled is susceptible.", "description_and_impact": "The Drag and Drop Multiple File Upload for Contact Form 7 plugin contains a missing ownership check in its delete functionality. Unauthenticated users can invoke the delete routine to remove any uploaded file when the \"Send attachments as links\" feature is turned on. This flaw allows unauthorized deletion of user\u2011supplied attachments, compromising data integrity and potentially disrupting site operations.", "risk_and_exploitability": "The vulnerability scores a CVSS of 3.7, indicating a low\u2011to\u2011moderate severity. The EPSS score is reported as < 1%, suggesting a very low likelihood of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. An attacker can trigger the deletion by sending an unauthenticated request to the plugin\u2019s delete endpoint; no special privileges or additional conditions beyond the enabled setting are required. The primary impact is loss of uploaded files, which may impact user experience and site functionality, but there is no direct path to code execution or data exfiltration."}}}}, "created": "2026-01-16T14:09:10.909472+00:00", "updated": "2026-04-22T15:45:20.873728+00:00", "vendors": ["codedropz", "codedropz$PRODUCT$drag_and_drop_multiple_file_upload_-_contact_form_7", "wordpress", "wordpress$PRODUCT$wordpress"]}