Description
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Drag and Drop Multiple File Upload Contact Form 7 | 5.0.6.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Nickguitar/Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal ★ 24 · Feb 4, 2023
Drag and Drop Multiple File Uploader PRO - Contact Form 7 v5.0.6.1 Path Traversal (CVE-2023-1112)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://vuldb.com/?id.222072 vdb-entry technical-description
- https://vuldb.com/?ctiid.222072 signature permissions-required
- https://github.com/Nickguitar/Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal exploit