CVE-2023-1112CWE-23

Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal

Medium · published March 1, 2023

CVSS v3.1
4.7
EPSS
3%
Percentile
87.3
In the wild
Unconfirmed
What it is

A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.03004 · 87.3th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2023-03-01T09:54Z
EPSS history
Timeline
  • 01 MAR 09:54Z
    Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal
    cvelistv5