A critical arbitrary file upload vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin exposes servers to potential remote code execution by unauthenticated attackers.

The plugin fails to perform sufficient file type validation within the dnd_upload_cf7_upload function. This allows unauthenticated attackers to bypass security controls and upload malicious files if the form is configured to accept all file types.

Successful exploitation of this vulnerability permits unauthorized remote code execution on the underlying web server. This poses a severe risk of total system compromise, data theft, and potential lateral movement within the network, which justifies the high CVSS score of 8.1.

Immediate Action: Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.5 or higher immediately. If an update is not currently possible, deactivate the plugin until a patch can be applied.

Proactive Monitoring: Monitor server access logs for suspicious file uploads or access requests to directories where uploads are stored, such as wp-content/uploads.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing suspicious file extensions or direct access to the vulnerable upload endpoint.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for remote code execution, this vulnerability represents a significant security risk to any WordPress site utilizing the affected plugin. Administrators should prioritize updating to the latest version immediately to close the injection vector and secure the application environment.