CVE-2024-3717 is an insecure storage vulnerability (CWE-922) in the Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress. Versions up to and including 1.3.7.7 store uploaded files in a publicly accessible directory ('/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files'), allowing unauthenticated attackers to retrieve sensitive information submitted via the plugin's file upload feature. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 3.1 base score is 5.3, reflecting a medium severity impact primarily on confidentiality.

An attacker can access sensitive files uploaded through the plugin without authentication, leading to exposure of potentially confidential data. There is no impact on integrity or availability reported. The vulnerability affects confidentiality only, with a medium severity score of 5.3. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory via web server configuration (e.g., using .htaccess rules or equivalent) to prevent unauthorized file access. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming official patches.