Vulnerabilidades do Codedropz Contact Form 7

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Codedropz Contact Form 7: 1 registro(s), com versões afetadas e correções.
cpe:2.3:a:codedropz:contact_form_7

CVE-2025-14457 Alta · 7.4 CWE-862 15/01/2026

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.