CVE-2025-14842

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14842", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-17T17:58:42.026Z", "datePublished": "2026-01-07T06:36:03.858Z", "dateUpdated": "2026-04-08T17:21:26.486Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:26.486Z"}, "affected": [{"vendor": "glenwpcoder", "product": "Drag and Drop Multiple File Upload for Contact Form 7", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.9.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload \u2013 Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can be used to achieve remote code execution on the server via direct file access, if the server is configured to execute .phar files as PHP. The upload of .svg files allows for Stored Cross-Site Scripting under certain circumstances."}], "title": "Drag and Drop Multiple File Upload \u2013 Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c78a0325-5bbf-4550-8477-94247f085e40?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php#L1116"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php#L108"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7/trunk/includes/formatting.php#L310"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3428236%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&old=3415946%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "timeline": [{"time": "2025-12-17T18:14:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-06T18:04:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:51:21.755346Z", "id": "CVE-2025-14842", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:13:40.970Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14842", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:51:21.755346Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:51:23.573Z"}}], "cna": {"title": "Drag and Drop Multiple File Upload \u2013 Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "glenwpcoder", "product": "Drag and Drop Multiple File Upload for Contact Form 7", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3.9.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-17T18:14:14.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-06T18:04:29.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c78a0325-5bbf-4550-8477-94247f085e40?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php#L1116"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php#L108"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7/trunk/includes/formatting.php#L310"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3428236%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&old=3415946%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload \u2013 Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can be used to achieve remote code execution on the server via direct file access, if the server is configured to execute .phar files as PHP. The upload of .svg files allows for Stored Cross-Site Scripting under certain circumstances."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-07T06:36:03.858Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14842", "state": "PUBLISHED", "dateUpdated": "2026-01-07T16:13:40.970Z", "dateReserved": "2025-12-17T17:58:42.026Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T06:36:03.858Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Drag and Drop Multiple File Upload for Contact Form 7", "vendor": "glenwpcoder", "versions": [{"lessThanOrEqual": "1.3.9.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload \u2013 Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary .phar or .svg files containing malicious PHP or JavaScript code. Malicious PHP code can be used to achieve remote code execution on the server via direct file access, if the server is configured to execute .phar files as PHP. The upload of .svg files allows for Stored Cross-Site Scripting under certain circumstances."}, {"lang": "es", "value": "El plugin Drag and Drop Multiple File Upload - Contact Form 7 para WordPress es vulnerable a la carga limitada de archivos con un tipo peligroso en todas las versiones hasta la 1.3.9.2, inclusive. Esto se debe a que el plugin no bloquea los archivos .phar y .svg. Esto permite que atacantes no autenticados carguen archivos .phar o .svg arbitrarios que contengan c\u00f3digo PHP o JavaScript malicioso. El c\u00f3digo PHP malicioso puede usarse para lograr la ejecuci\u00f3n remota de c\u00f3digo en el servidor a trav\u00e9s del acceso directo a archivos, si el servidor est\u00e1 configurado para ejecutar archivos .phar como PHP. La carga de archivos .svg permite el cross-site scripting almacenado bajo ciertas circunstancias."}], "id": "CVE-2025-14842", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14842", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:51:21.755346Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:56.873", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contact-form-7/trunk/includes/formatting.php#L310"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php#L108"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php#L1116"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3428236%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&old=3415946%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c78a0325-5bbf-4550-8477-94247f085e40?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:35:01.658209+00:00", "value": {"mitigation_remediation": ["Update the Drag and Drop Multiple File Upload for Contact\u00a0Form\u00a07 plug\u2011in to the latest released version if available; if no update exists, remove the plug\u2011in or disable file uploads.", "Upgrade the core Contact Form\u00a07 plugin to the latest stable release if still running an older version.", "Use a security plug\u2011in or custom configuration to whitelist allowed file types, excluding .phar and .svg files.", "Configure the web\u2011server to prohibit execution of .phar files in the upload directory, preventing execution even if a malicious file arrives."], "summary": {"action": "Implement Workaround", "impact": "Remote Code Execution and Stored XSS via unfiltered file upload"}, "threat_synthesis": {"affected_systems": "The issue affects all versions of the Drag and Drop Multiple File Upload for Contact\u00a0Form\u00a07 plug\u2011in (vendor glenwpcoder) up to and including 1.3.9.2. The plug\u2011in extends the core Contact Form\u00a07 plugin, so any WordPress site running both components with a vulnerable plug\u2011in version is at risk. Site owners should verify the presence and version of the add\u2011on.", "description_and_impact": "The Drag and Drop Multiple File Upload for Contact\u00a0Form\u00a07 plugin for WordPress is vulnerable to an unauthenticated limited file upload exploit that allows attackers to upload .phar or .svg files containing malicious PHP or JavaScript code. The vulnerability arises from improper file type validation, enabling the acceptance of dangerous file types with no restriction. This flaw permits attackers to place executable scripts on the server, potentially leading to remote code execution if the server is configured to execute .phar files, or to Stored Cross\u2011Site Scripting via .svg files under certain conditions. The flaw is classified as CWE\u2011434.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests low exploitation probability as of the latest data, and the vulnerability is not yet listed in CISA KEV. However, the presence of unfiltered .phar uploads can enable a remote code execution path if the host\u2019s web server is configured to treat .phar files as PHP, a scenario that is common in misconfigured environments. Attackers can exploit this via the public faces of Contact\u00a0Form\u00a07 forms, so the attack vector is unauthenticated and remote."}}}}, "created": "2026-01-08T09:49:37.371627+00:00", "updated": "2026-04-21T00:45:23.090449+00:00", "vendors": ["codedropz", "codedropz$PRODUCT$drag_and_drop_multiple_file_upload_-_contact_form_7", "wordpress", "wordpress$PRODUCT$wordpress"]}