CVE-2025-3515 is a vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin caused by insufficient file type validation, allowing arbitrary file uploads. Attackers can upload files with dangerous extensions like .phar, potentially leading to remote code execution on servers that treat these files as executable PHP scripts. This is particularly relevant for default Apache+mod_php configurations where file extension checks are not strictly enforced. The vulnerability affects all versions up to and including 1.3.8.9. The CVSS v3.1 base score is 8.1, indicating a high severity. No patch or official fix has been documented yet, and no exploits are currently known in the wild.

Successful exploitation allows unauthenticated attackers to upload arbitrary files with dangerous extensions, such as .phar, to the affected server. If the server is configured to execute these files as PHP scripts (common in default Apache+mod_php environments), this can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical impact on system security if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the vulnerable plugin or restricting file upload capabilities. Additionally, server configurations should be hardened to prevent execution of uploaded files with dangerous extensions, for example by disabling execution of .phar files or enforcing strict file type validation at the server level.