A path traversal vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin allows unauthenticated attackers to read arbitrary files accessible by the web server.

This is a path traversal vulnerability (CWE-22) occurring because the plugin fails to sanitize user-supplied input in the mfile[] POST parameter. Unauthenticated attackers can manipulate this input to bypass directory boundaries and read sensitive files within the wp-content directory.

The ability for an unauthenticated attacker to read arbitrary files poses a significant risk to data confidentiality. Attackers could potentially exfiltrate configuration files, sensitive user data, or other proprietary information stored within the web directory. With a CVSS score of 7.5, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized data disclosure.

Immediate Action: Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to the version containing the security fix (post-1.3.9.6).

Proactive Monitoring: Review web server access logs for suspicious POST requests containing path traversal sequences, such as multiple instances of "../" or encoded directory navigation patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests that contain path traversal sequences in the mfile[] parameter.

Public Exploit Available: No.

Given the ease with which unauthenticated attackers can leverage this flaw to access sensitive files, organizations using this plugin must prioritize its update. If an immediate update is not feasible, administrators should consider deactivating the plugin until a secure version is deployed to eliminate the attack surface.