Drag and Drop Multiple File Upload – Contact Form 7, CVE-2025-14457
- CVE, Research URL
- Published on
- Jan 15, 2026
- Research Description
- The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.
- Affected versions
-
max 1.3.9.3.
- Status
-
vulnerable