Vulnerability Description
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.9.2. This makes it possible for unauthenticated attackers to delete arbitrary uploaded files when the "Send attachments as links" setting is enabled.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Codedropz | Contact Form 7 | <= 1.3.9.2 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/changeset/3428236/drag-and-drop-multiple-filePatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1a182243-b24a-4c46-8b6Third Party Advisory
FAQ
What is CVE-2025-14457?
CVE-2025-14457 is a vulnerability with a CVSS score of 3.7 (LOW). The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedropz_upload_delete() ...
How severe is CVE-2025-14457?
CVE-2025-14457 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-14457?
Check the references section above for vendor advisories and patch information. Affected products include: Codedropz Contact Form 7.