CVE-2025-14842 is a vulnerability in the glenwpcoder Drag and Drop Multiple File Upload plugin for Contact Form 7 that permits limited upload of dangerous file types (.phar and .svg) due to insufficient validation. Attackers can upload malicious .phar files potentially leading to remote code execution if the server executes these files as PHP. Additionally, uploading .svg files may enable stored cross-site scripting attacks. The vulnerability affects all versions up to and including 1.3.9.2. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts.

An attacker can upload malicious .phar files that may be executed as PHP code on the server, leading to remote code execution if server configuration allows. Uploading .svg files can result in stored cross-site scripting attacks, potentially compromising users interacting with the affected site. The vulnerability requires no privileges but does require user interaction. The overall impact is medium severity with potential confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable file uploads in the plugin, especially for .phar and .svg file types. Implement server-side controls to prevent execution of .phar files as PHP. Monitor for plugin updates from the vendor that address this vulnerability.