CVE-2025-14457: CWE-862 Missing Authorization in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.
AI Analysis
Technical Summary
The Drag and Drop Multiple File Upload for Contact Form 7 plugin suffers from a missing ownership check in its file deletion function (dnd_codedropz_upload_delete()), which permits unauthenticated users to delete arbitrary uploaded files if the "Send attachments as links" feature is enabled. This vulnerability affects all plugin versions up to and including 1.3.9.2. The CVSS 3.1 base score is 3.7, indicating low severity, with attack vector network, high attack complexity, no privileges required, no user interaction, and limited impact on integrity only.
Potential Impact
An unauthenticated attacker can delete arbitrary uploaded files associated with the plugin when the "Send attachments as links" setting is enabled. This results in limited integrity impact due to unauthorized modification (deletion) of data. There is no confidentiality or availability impact reported. No known exploits are documented in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling the "Send attachments as links" setting to reduce exposure to this vulnerability.
CVE-2025-14457: CWE-862 Missing Authorization in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7
Description
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Drag and Drop Multiple File Upload for Contact Form 7 plugin suffers from a missing ownership check in its file deletion function (dnd_codedropz_upload_delete()), which permits unauthenticated users to delete arbitrary uploaded files if the "Send attachments as links" feature is enabled. This vulnerability affects all plugin versions up to and including 1.3.9.2. The CVSS 3.1 base score is 3.7, indicating low severity, with attack vector network, high attack complexity, no privileges required, no user interaction, and limited impact on integrity only.
Potential Impact
An unauthenticated attacker can delete arbitrary uploaded files associated with the plugin when the "Send attachments as links" setting is enabled. This results in limited integrity impact due to unauthorized modification (deletion) of data. There is no confidentiality or availability impact reported. No known exploits are documented in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling the "Send attachments as links" setting to reduce exposure to this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-12-10T14:55:41.035Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 696891250b074b1fa58c19b1
Added to database: 1/15/2026, 7:03:01 AM
Last enriched: 4/9/2026, 9:16:26 PM
Last updated: 5/9/2026, 9:42:53 PM
Views: 141
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.