CVE-2025-14457 identifies a missing authorization vulnerability (CWE-862) in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress, specifically in the dnd_codedropz_upload_delete() function. This function lacks an ownership or permission check before deleting uploaded files, which allows unauthenticated attackers to delete arbitrary files uploaded via the plugin. The vulnerability is present in all versions up to and including 1.3.9.2. Exploitation requires the plugin's 'Send attachments as links' setting to be enabled, which changes how uploaded files are handled and referenced. The attack vector is network-based with no privileges or user interaction required, but the attack complexity is high due to the need to identify valid file references. The impact is limited to integrity, as attackers can delete files but cannot read or modify their contents or affect availability of the site. No patches or exploit code are currently publicly available, and no active exploitation has been reported. The vulnerability is rated with a CVSS v3.1 score of 3.7 (low severity), reflecting limited impact and exploitation difficulty. This vulnerability is relevant for WordPress sites using this plugin, which is popular for enhancing Contact Form 7 with drag-and-drop file upload capabilities.

For European organizations, the primary impact is the unauthorized deletion of uploaded files submitted through Contact Form 7 forms using this plugin with the vulnerable setting enabled. This can result in loss of user-submitted data such as documents, images, or other attachments, potentially disrupting business processes that rely on these uploads (e.g., customer support, job applications, or service requests). While the vulnerability does not expose sensitive data or cause denial of service, the integrity loss can undermine user trust and require operational recovery efforts. Organizations with high reliance on WordPress forms for customer interaction or internal workflows may experience moderate operational inconvenience. The absence of known exploits reduces immediate risk, but the vulnerability could be targeted in the future, especially in sectors with high web presence. The impact is more pronounced for SMEs and public sector entities that may lack rapid patch management capabilities.

1. Immediately verify if the 'Send attachments as links' setting is enabled in the Drag and Drop Multiple File Upload for Contact Form 7 plugin and disable it if not strictly necessary. 2. Monitor and audit the upload directories for unauthorized file deletions or anomalies. 3. Implement strict file system permissions to limit deletion capabilities to authorized processes only. 4. Keep WordPress core, Contact Form 7, and all related plugins updated; apply vendor patches promptly once available for this vulnerability. 5. Consider deploying Web Application Firewalls (WAF) with custom rules to detect and block suspicious requests targeting the vulnerable function. 6. Educate site administrators about this vulnerability and encourage regular backups of uploaded files to enable recovery. 7. Review and harden overall WordPress security posture, including limiting plugin usage to trusted sources and minimizing attack surface.