The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress suffers from CWE-73: External Control of File Name or Path. Specifically, the dnd_codedropz_upload_delete() function does not sufficiently validate file paths, enabling unauthenticated attackers to delete certain arbitrary files on the server. This vulnerability affects all versions up to and including 1.3.8.5. However, protections prevent deletion of critical files like wp-config.php, limiting the impact to file deletion without enabling remote code execution. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity loss.

An unauthenticated attacker can delete limited arbitrary files on the affected server, potentially disrupting service or deleting important data. The inability to delete critical files such as wp-config.php mitigates the risk of remote code execution. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin's file deletion functionality or disabling the plugin if feasible. Monitor for vendor updates and apply patches promptly once available.