Critical · published July 2, 2025
🚨 An attacker can sneak in any file they please! Thanks to missing file type validation in the WooCommerce Drag and Drop Multiple File Upload (Pro) plugin, this vulnerability opens the door to arbitrary file uploads. 🔥 Imagine a restaurant that lets anyone walk in and leave any kind of dish in the kitchen, no questions asked. This means that a malicious chef could slip in a recipe for disaster instead of a tasty meal, potentially ruining the entire operation! With this vulnerability, unauthenticated attackers can upload arbitrary files to your server, opening the door to devastating possibilities like remote code execution. Even if PHP execution is usually blocked, crafty attackers may manipulate server configurations to bypass these defenses, leading to a catastrophic breach of your site!
Imagine a restaurant that lets anyone walk in and leave any kind of dish in the kitchen, no questions asked. This means that a malicious chef could slip in a recipe for disaster instead of a tasty meal, potentially ruining the entire operation! The vulnerability lies in the dnd_upload_cf7_upload_chunks() function of the Drag and Drop Multiple File Upload (Pro) plugin, versions 5.0 to 5.0.5 (when bundled with the PrintSpace theme) and all versions up to 1.7.1. Due to missing file type validation, attackers can upload any file type, including potentially harmful scripts.
With this vulnerability, unauthenticated attackers can upload arbitrary files to your server, opening the door to devastating possibilities like remote code execution. Even if PHP execution is usually blocked, crafty attackers may manipulate server configurations to bypass these defenses, leading to a catastrophic breach of your site! To protect your site, immediately update the WooCommerce Drag and Drop Multiple File Upload (Pro) plugin to the latest version. Ensure that you review your server's file upload settings and implement strict file type validation to prevent unauthorized uploads. 🔒 You've got this! With these steps, you can secure your site and become a security hero! 🦸♂️