Security Advisory

CVE-2025-14457

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-01-15 06:45:04

Last updated 2026-04-08 16:37:59

Assigner Wordfence

CVSS score 3.7

State PUBLISHED

Description

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.

← Browse all CVEs View on cve.org ↗