The Drag and Drop Multiple File Upload for Contact Form 7 plugin contains a critical code injection vulnerability that could result in full site compromise.

This is a code injection vulnerability (CWE-94) that can be triggered without authentication. By manipulating input parameters, an attacker may be able to force the application to execute unintended code.

This vulnerability carries a CVSS score of 8.1, reflecting the ability for an attacker to achieve total impact on confidentiality, integrity, and availability. Successful exploitation typically leads to full site takeover, potential malware distribution, or unauthorized access to the underlying server environment.

Immediate Action: Update the plugin to version 1.3.9.9 or later immediately. If an update is not available for your specific environment, deactivate the plugin to neutralize the risk.

Proactive Monitoring: Review web server access logs for suspicious file upload requests or unusual POST requests directed at plugin-specific endpoints.

Compensating Controls: Implement file integrity monitoring and ensure the web server user has restricted permissions to prevent arbitrary code execution from escalating to system-level access.

Public Exploit Available: Unknown

Given the severity of code injection, immediate patching is required. Organizations should treat this as an urgent remediation task to ensure the security of their WordPress infrastructure and hosted data.