An unauthenticated arbitrary file upload vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin allows remote attackers to execute arbitrary code on the server.

This flaw, categorized as CWE-434, stems from inadequate file type validation and a bypass of the wpcf7_antiscript_file_name() function. Unauthenticated attackers can exploit this to upload malicious files, such as PHP scripts, directly to the server to achieve remote code execution.

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress site, leading to potential data theft, site defacement, or total system compromise. Given the CVSS score of 8.1, the high potential for total system impact necessitates immediate attention to prevent unauthorized access and potential lateral movement within the hosting environment.

Immediate Action: Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to the latest available version that includes the comprehensive fix for both the initial vulnerability and the subsequent patch bypass.

Proactive Monitoring: Review web server access logs for requests targeting file upload directories, particularly those containing suspicious file extensions or non-ASCII characters in filenames.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing executable extensions or suspicious patterns, and restrict direct access to the upload directory.

Public Exploit Available: Yes, multiple proof-of-concept repositories have been published on GitHub.

This vulnerability presents a severe risk due to the potential for remote code execution by unauthenticated actors. Administrators must audit their WordPress installations immediately to identify and update the vulnerable plugin. Failure to patch allows for trivial exploitation, making the application of the vendor-provided update the only reliable method to secure the system.