CVE-2025-2328: Arbitrary File Access in Drag and Drop Multiple File Upload

The core of the vulnerability lies in insufficient file path validation within the 'dndremoveuploaded_files' function. An attacker can craft malicious file paths, including directory traversal sequences (e.g., ../../../../wp-config.php), to target arbitrary files on the server. While direct remote code execution isn't immediately possible, the ability to delete files, especially sensitive configuration files like wp-config.php, significantly elevates the risk. The presence of the Flamingo plugin exacerbates the impact, as it provides a mechanism (the message deletion feature) for an attacker to trigger the file deletion. Successful exploitation could lead to complete compromise of the WordPress installation, including data theft, website defacement, and further malicious activity.

1. Reserved2025-03-14
2. Published2025-03-28
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the Drag and Drop Multiple File Upload for Contact Form 7 plugin to a version that addresses this vulnerability. The vendor has not specified a fixed version, so monitor their official channels for updates. As a temporary workaround, if upgrading is not immediately feasible, consider disabling the Flamingo plugin, as it is a necessary component for exploitation. Additionally, implement strict file access controls on the WordPress server to limit the impact of potential file deletions. Review WordPress user permissions to ensure only authorized personnel have administrative access. After upgrading, confirm the fix by attempting to upload and delete files through the plugin, verifying that the file path validation is functioning correctly.