Drag and Drop Multiple File Upload – Contact Form 7, CVE-2024-3717
- CVE, Research URL
- Published on
- May 02, 2024
- Research Description
- The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
- Affected versions
-
Min -, max 1.3.7.8.
- Status
-
vulnerable