CVE-2022-3282 Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass
Attackers can bypass file upload size limits in the Drag and Drop Multiple File Upload WordPress plugin by manipulating user input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3282?
CVE-2022-3282 is a medium-severity vulnerability in Unknown Drag and Drop Multiple File Upload – Contact Form 7, published on 17 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.
Weakness: CWE-639
Which versions are affected by CVE-2022-3282?
It affects 1 product.
Products include Codedropz Drag and Drop Multiple File Upload - Contact Form 7.
How do I fix CVE-2022-3282?
No fix has been published for CVE-2022-3282 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3282 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3282 exists.
Other vulnerabilities in Unknown Drag and Drop Multiple File Upload – Contact Form 7
- CVE-2020-12800 File upload in n/a
- CVE-2025-2328 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion
- CVE-2025-3515 File upload in Drag and Drop Multiple File Upload for Contact Form 7
- CVE-2023-5822 Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload
- CVE-2025-2485 Deserialization in Drag and Drop Multiple File Upload for Contact Form 7
Sources
Also known as GHSA-m3g2-fxc2-5839.