{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8464", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-01T15:47:19.302Z", "datePublished": "2025-08-16T07:25:28.619Z", "dateUpdated": "2026-04-08T16:37:33.117Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:33.117Z"}, "affected": [{"vendor": "glenwpcoder", "product": "Drag and Drop Multiple File Upload for Contact Form 7", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.9.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7_guest_user_id cookie. This makes it possible for unauthenticated attackers to upload and delete files outside of the originally intended directory. The impact of this vulnerability is limited, as file types are validated and only safe ones can be uploaded, while deletion is limited to the plugin's uploads folder."}], "title": "Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17f7be7f-f675-4c9f-a7b3-525a3c3c5775?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1018"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1050"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L77"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3344512%40drag-and-drop-multiple-file-upload-contact-form-7&new=3344512%40drag-and-drop-multiple-file-upload-contact-form-7&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-23 Relative Path Traversal", "cweId": "CWE-23", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Thien Tran"}], "timeline": [{"time": "2025-07-09T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-08-01T16:02:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-15T19:13:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-18T17:50:55.939422Z", "id": "CVE-2025-8464", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T17:51:17.240Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8464", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-18T17:50:55.939422Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T17:51:06.287Z"}}], "cna": {"title": "Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie", "credits": [{"lang": "en", "type": "finder", "value": "Thien Tran"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "glenwpcoder", "product": "Drag and Drop Multiple File Upload for Contact Form 7", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3.9.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-09T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-08-01T16:02:49.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-15T19:13:08.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17f7be7f-f675-4c9f-a7b3-525a3c3c5775?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1018"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1050"}, {"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L77"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3344512%40drag-and-drop-multiple-file-upload-contact-form-7&new=3344512%40drag-and-drop-multiple-file-upload-contact-form-7&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7_guest_user_id cookie. This makes it possible for unauthenticated attackers to upload and delete files outside of the originally intended directory. The impact of this vulnerability is limited, as file types are validated and only safe ones can be uploaded, while deletion is limited to the plugin's uploads folder."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-08-16T07:25:28.619Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8464", "state": "PUBLISHED", "dateUpdated": "2025-08-18T17:51:17.240Z", "dateReserved": "2025-08-01T15:47:19.302Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-16T07:25:28.619Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7_guest_user_id cookie. This makes it possible for unauthenticated attackers to upload and delete files outside of the originally intended directory. The impact of this vulnerability is limited, as file types are validated and only safe ones can be uploaded, while deletion is limited to the plugin's uploads folder."}, {"lang": "es", "value": "El complemento Drag and Drop Multiple File Upload for Contact Form 7 para WordPress es vulnerable a Directory traversal en todas las versiones hasta la 1.3.9.0 incluida, a trav\u00e9s de la cookie wpcf7_guest_user_id. Esto permite que atacantes no autenticados suban y eliminen archivos fuera del directorio original. El impacto de esta vulnerabilidad es limitado, ya que los tipos de archivo se validan y solo se pueden subir los seguros, mientras que la eliminaci\u00f3n se limita a la carpeta de subidas del plugin."}], "id": "CVE-2025-8464", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-08-16T08:15:27.493", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1018"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L1050"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.9.0/inc/dnd-upload-cf7.php#L77"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3344512%40drag-and-drop-multiple-file-upload-contact-form-7&new=3344512%40drag-and-drop-multiple-file-upload-contact-form-7&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17f7be7f-f675-4c9f-a7b3-525a3c3c5775?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:00:19.885642+00:00", "value": {"mitigation_remediation": ["Apply the latest plugin update that removes the vulnerable cookie handling.", "Re\u2011evaluate the upload directory permissions to ensure only the web server can write to it and disable direct file execution if not required.", "Implement monitoring of the plugin's uploads folder to detect unexpected file creations or deletions."], "summary": {"action": "Patch Now", "impact": "Directory Traversal allowing unauthenticated upload and deletion of files outside the intended plugin directory"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Drag and Drop Multiple File Upload for Contact Form 7 plugin, version 1.3.9.0 and earlier. The vulnerability affects all releases up to and including 1.3.9.0, as published by the plugin author glenwpcoder.", "description_and_impact": "The vulnerability resides in the Drag and Drop Multiple File Upload for Contact Form 7 plugin and permits an attacker to craft a malicious wpcf7_guest_user_id cookie, enabling directory traversal. Affected administrators can upload files that resolve to path locations outside the designated upload directory and can delete files within that folder, though only supported MIME types are allowed on upload. The attack does not grant full system compromise, but it could lead to the insertion of malicious content that might be executed if later viewed or may facilitate removal of legitimate files.", "risk_and_exploitability": "With a CVSS score of 5.3, the vulnerability is considered moderate severity. The EPSS score of 1% indicates low but non\u2011zero exploitation probability. Since the issue is not listed in the CISA KEV catalog, no widespread zero\u2011day exploits have been reported. Attackers who set a crafted wpcf7_guest_user_id cookie can trigger the vulnerability without authentication, typically by accessing a single upload page or embedding the cookie in a request. The impact is confined to files within the plugin's upload directory, but the ability to add arbitrary files could be leveraged for future phishing or malware delivery."}}}}, "created": "2026-04-22T17:15:22.189043+00:00", "updated": "2026-04-22T17:15:22.189080+00:00", "vendors": []}