An unauthenticated arbitrary file upload vulnerability in the Drag and Drop File Upload for Contact Form 7 plugin poses a critical risk of remote code execution.

The plugin fails to correctly sanitize file extensions during the upload process, allowing unauthenticated attackers to bypass intended restrictions and upload arbitrary files. The flaw stems from a discrepancy between the validation logic and the final file saving process, which can be manipulated to bypass security controls.

A successful exploit of this vulnerability could grant an attacker the ability to execute arbitrary PHP code on the underlying web server. This level of compromise typically leads to full site takeover, unauthorized access to sensitive database information, and potential lateral movement within the hosting environment. Given the high CVSS score of 8.1, the risk of total system compromise is substantial.

Immediate Action: There is no confirmed patch available; immediately deactivate and remove the plugin from all WordPress installations until a vendor-supplied fix is released and verified.

Proactive Monitoring: Monitor web server access logs for unusual requests to upload directories or attempts to access newly created files with suspicious extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads that do not match expected MIME types or contain suspicious character sequences.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

This vulnerability presents a high risk due to the potential for unauthenticated remote code execution. Administrators must treat this as a priority and remove the vulnerable component immediately, as no patch is currently available. Continued use of this plugin in its current state is strongly discouraged until a secure version is confirmed by the vendor.