CVE-2025-8464

🗓️ 16 Aug 2025 07:25:28Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 18 Views

Directory traversal in Contact Form 7 Drag and Drop Upload via guest_user_id cookie allows unauthenticated upload and deletion; safe types only; deletions limited to uploads folder; versions up to 1.3.9.0

Reporter	Title	Published	Views	Family All 9
CNNVD	WordPress plugin Drag and Drop Multiple File Upload for Contact Form 安全漏洞	16 Aug 202500:00	–	cnnvd
Cvelist	CVE-2025-8464 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie	16 Aug 202507:25	–	cvelist
EUVD	EUVD-2025-25136	3 Oct 202520:07	–	euvd
NVD	CVE-2025-8464	16 Aug 202508:15	–	nvd
Patchstack	WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie vulnerability	16 Aug 202502:12	–	patchstack
Positive Technologies	PT-2025-33542 · WordPress · Drag/Drop Multiple File Upload – Contact Form 7	16 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-8464	18 Aug 202508:25	–	redhatcve
Vulnrichment	CVE-2025-8464 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie	16 Aug 202507:25	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (August 11, 2025 to August 17, 2025)	21 Aug 202514:13	–	wordfence

Vulners

Node

glenwpcoder drag_and_drop_multiple_file_upload_for_contact_form_7Range≤1.3.9.0wordpress

[
  {
    "vendor": "glenwpcoder",
    "product": "Drag and Drop Multiple File Upload for Contact Form 7",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.3.9.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php
plugins	www.plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/17f7be7f-f675-4c9f-a7b3-525a3c3c5775
plugins	www.plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php

15 Apr 2026 00:35Current

7.2High risk

Vulners AI Score7.2

CVSS 3.15.3

EPSS0.01988

SSVC

CWE-23