CVE-2025-14457CWE-862

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion

Low · published January 15, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-15T06:45Z
EPSS history
Timeline
  • 15 JAN 06:45Z
    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion
    cvelistv5