CVE-2025-5746 is a critical vulnerability in the CodeDropz Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress. The issue arises from the dnd_upload_cf7_upload_chunks() function lacking proper file type validation, enabling unauthenticated attackers to upload arbitrary files to the affected server. Although PHP execution is generally disabled via .htaccess, some server configurations may still allow remote code execution. The vulnerability affects versions 5.0 to 5.0.5 when bundled with the PrintSpace theme and all standalone versions up to 1.7.1. No official patch or remediation link is provided in the data, and no known exploits are reported in the wild as of the publication date.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution depending on server configuration. This can compromise confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects the high impact and ease of exploitation over the network without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin versions or restricting file upload capabilities via server-level controls. Review and harden server configurations to ensure PHP execution is effectively disabled in upload directories.