Skip to content
OpenAdvisories
Critical · 10.0 CVE-2025-53283 EUVD-2025-37997GHSA-vpqx-2jhq-wrpw

WordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin <= 2.4.1 - Arbitrary File Upload Vulnerability

Published Nov 6, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through <= 2.4.1.

Affected products

VendorProductAffectedFixed
borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon ≤ 2.4.1 —

References