CVE-2025-3515

🗓️ 17 Jun 2025 09:21:39Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 204 Views🌐 WEB

Vulnerability in Contact Form 7 plugin allows unauthenticated file uploads leading to remote code execution.

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Codedropz Drag_And_Drop_Multiple_File_Upload_-_Contact_Form_7	3 Sep 202509:43	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Codedropz Drag_And_Drop_Multiple_File_Upload_-_Contact_Form_7	1 Sep 202515:50	–	githubexploit
Circl	CVE-2025-3515	17 Jun 202509:41	–	circl
CNNVD	WordPress plugin Drag and Drop Multiple File Upload for Contact Form 代码问题漏洞	17 Jun 202500:00	–	cnnvd
Cvelist	CVE-2025-3515 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks	17 Jun 202509:21	–	cvelist
EUVD	EUVD-2025-18492	3 Oct 202520:07	–	euvd
Nuclei	Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload	27 Jun 202603:01	–	nuclei
NVD	CVE-2025-3515	17 Jun 202510:15	–	nvd
OSV	CVE-2025-3515	17 Jun 202510:15	–	osv
Patchstack	WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks vulnerability	17 Jun 202507:49	–	patchstack

NVD

Vulners

Node

codedropz drag_and_drop_multiple_file_upload_-_contact_form_7Range<1.3.9.0wordpress

[
  {
    "vendor": "glenwpcoder",
    "product": "Drag and Drop Multiple File Upload for Contact Form 7",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.3.8.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.8.8/inc/dnd-upload-cf7.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e1298242-61d2-495e-bae7-96b5e12bd03d
plugins	www.plugins.trac.wordpress.org/changeset/3310153/

Parameter	Position	Path	Description	CWE
dnd_upload_cf7_upload	path	wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/inc/dnd-upload-cf7.php	Arbitrary file upload vulnerability in the plugin via dnd_upload_cf7_upload function	CWE-434
action=dnd_codedropz_upload	path	wp-admin/admin-ajax.php	Unauthenticated file upload via WordPress admin-ajax hook dnd_codedropz_upload	CWE-434

17 Jun 2026 09:20Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.1 - 9.8

EPSS0.0509

SSVC

CWE-434