WooCommerce Drag and Drop Multiple File Upload Pro Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress. This issue arises from inadequate file type validation in the 'dnd_upload_cf7_upload_chunks()' function. The vulnerability affects versions 5.0 to 5.0.5 (when used with the PrintSpace theme) and all versions up to and including 1.7.1 (in the standalone version). As a result, unauthenticated attackers can upload arbitrary files to the affected site's server, potentially leading to remote code execution. Although PHP execution is generally disabled via a .htaccess file, it remains possible in certain server configurations.

Impact

Exploitation of this vulnerability allows for unauthenticated arbitrary file uploads, which could be used to upload malicious files that may be executed on the server, potentially leading to remote code execution.

Remediation

Users are advised to update to version 1.7.2 or 5.0.7, both of which contain the necessary patch.