sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-12267 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion

Medium 5.3 Published Updated

Unauthenticated attackers can delete limited arbitrary files on the server due to insufficient path validation in the plugin.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2024-12267?

CVE-2024-12267 is a medium-severity path traversal vulnerability in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7, published on 31 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.

Weakness: CWE-73

Which versions are affected by CVE-2024-12267?

It affects 1 product.

Products include Codedropz Drag and Drop Multiple File Upload - Contact Form 7.

How do I fix CVE-2024-12267?

No fix has been published for CVE-2024-12267 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-12267 being exploited?

There is no known exploitation of CVE-2024-12267 in the wild and no public exploit code.

Sources

Also known as GHSA-wgmv-5488-h5p5.

Is CVE-2024-12267 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free