CVE-2023-5822

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if a user authorized to edit form, which means editor privileges or above, has added a 'multiple file upload' form field with '*' acceptable file types.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Nov 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-58238.8Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.CVE-2023-58247.5A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a CVE-2023-58256.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before CVE-2023-58268.8A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some un CVE-2023-58279.8A vulnerability was found in Shanghai CTI Navigation CTI Monitoring and Early Warning System 2.2. It has been classified as critical. This a CVE-2023-58289.8A vulnerability was found in Nanning Ontall Longxing Industrial Development Zone Project Construction and Installation Management System up CVE-2023-58298.8A vulnerability was found in code-projects Admission Management System 1.0. It has been rated as critical. Affected by this issue is some un CVE-2023-58309.8A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authen CVE-2023-58315.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before CVE-2023-58329.1Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.CVE-2023-58338.8Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.CVE-2023-58347.8HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential f