WordPress Drag and Drop Multiple File Upload Contact Form 7 Plugin Limited Arbitrary File Deletion Vulnerability

A vulnerability allowing limited arbitrary file deletion has been identified in the Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress, affecting all versions through 1.3.8.5. The issue arises from inadequate file path validation in the dnd_codedropz_upload_delete() function, which enables unauthenticated attackers to delete certain files on the server. However, files that could facilitate remote code execution, such as wp-config.php, cannot be deleted.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files on the server, potentially causing data loss or disruption of service.

Remediation

Users are advised to update the plugin to version 1.3.8.6 or a newer patched version.