{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3515 exists.","fix":"No fix has been published for CVE-2025-3515 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-3515 is a high-severity vulnerability in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7, published on 17 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-3515 and fix it if it is affected.\n\nWhat it is: CVE-2025-3515 is a high-severity vulnerability in glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7, published on 17 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3515 exists.\n\nAffected product: glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-3515/ (Markdown: https://insights.sbomify.com/CVE-2025-3515/index.md)","id":"CVE-2025-3515","markdown":"https://insights.sbomify.com/CVE-2025-3515/index.md","name":"CVE-2025-3515","record":{"aliases":["GHSA-63j5-3fh3-7x8g"],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"WordPress plugin","requires_auth":"none","summary":"Unauthenticated attackers can upload dangerous files like .phar to achieve remote code execution on vulnerable WordPress sites.","user_interaction":"not_required","vuln_class":"file_upload"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Wordfence","cpe":[{"product":"drag_and_drop_multiple_file_upload_-_contact_form_7","vendor":"codedropz"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"description":"The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2025-06-22","github_poc":3,"max_poc_stars":18,"metasploit":0,"nuclei":1,"refs":[{"date":"2025-09-01T15:50:43Z","kind":"github_poc","ref":"https://github.com/blueisbeautiful/CVE-2025-3515","stars":18,"title":"WordPress File Upload RCE Exploit"},{"date":"2025-06-22T21:00:10Z","kind":"github_poc","ref":"https://github.com/Professor6T9/CVE-2025-3515","stars":1,"title":"CVE‑2025‑3515 — Drag and Drop Multiple File Upload for Contact Form 7"},{"date":"2025-09-03T09:43:06Z","kind":"github_poc","ref":"https://github.com/ImBIOS/lab-cve-2025-3515","stars":1,"title":"CVE-2025-3515 WordPress lab for Drag and Drop Multiple File Upload for CF7: Dockerized PoC \u0026 Nuclei testing"},{"date":null,"kind":"nuclei","ref":"http/cves/2025/CVE-2025-3515.yaml","stars":null,"title":"Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload"}],"tier":"weaponised"},"has_fix":null,"headline":"File upload in Drag and Drop Multiple File Upload for Contact Form 7","id":"CVE-2025-3515","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"file_upload","year":"2025"},"n_packages":0,"n_references":3,"next":{"headline":"Simple Lightbox \u003c 2.9.4 - Contributor+ Stored XSS","id":"CVE-2025-3516"},"packages":[],"prev":{"headline":"SureForms \u003c 1.4.4 - Admin+ Stored XSS","id":"CVE-2025-3514"},"products":["Drag and Drop Multiple File Upload for Contact Form 7"],"published":"2025-06-17","related":[{"cvss_score":9.8,"headline":"File upload in n/a","id":"CVE-2020-12800","kev_date_added":null,"published":"2020-06-08"},{"cvss_score":8.8,"headline":"Drag and Drop Multiple File Upload for Contact Form 7 \u003c= 1.3.8.7 - Unauthenticated Arbitrary File Deletion","id":"CVE-2025-2328","kev_date_added":null,"published":"2025-03-28"},{"cvss_score":8.1,"headline":"Drag and Drop Multiple File Upload - Contact Form 7 \u003c= 1.3.7.3 - Unauthenticated Arbitrary File Upload","id":"CVE-2023-5822","kev_date_added":null,"published":"2023-11-22"},{"cvss_score":7.5,"headline":"Deserialization in Drag and Drop Multiple File Upload for Contact Form 7","id":"CVE-2025-2485","kev_date_added":null,"published":"2025-03-28"},{"cvss_score":6.1,"headline":"Drag and Drop Multiple File Upload PRO - Reflected Cross-Site Scripting","id":"CVE-2023-1282","kev_date_added":null,"published":"2023-04-17"},{"cvss_score":5.4,"headline":"Cross-site request forgery in Drag and Drop Multiple File Upload – Contact Form 7","id":"CVE-2022-45364","kev_date_added":null,"published":"2023-05-24"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-04-08","vendors":["glenwpcoder"]},"summary":"Unauthenticated attackers can upload dangerous files like .phar to achieve remote code execution on vulnerable WordPress sites.","url":"https://insights.sbomify.com/CVE-2025-3515/"}