5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
9.2 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
16.7%
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the ‘/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files’ directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
[
{
"vendor": "glenwpcoder",
"product": "Drag and Drop Multiple File Upload – Contact Form 7",
"versions": [
{
"version": "*",
"status": "affected",
"lessThanOrEqual": "1.3.7.7",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3077555%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&old=3061101%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&sfp_email=&sfph_mail=
www.wordfence.com/threat-intel/vulnerabilities/id/153cb585-4eea-4959-85b1-2487be11f116?source=cve
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
9.2 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
16.7%