CVE-2025-14457

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress versions up to and including 1.3.9.2

Description The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is susceptible to unauthorized modification of data. This is due to a missing ownership check within the dnd codedropz upload delete() function. This allows unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.

Recommendations Update to a version beyond 1.3.9.2.