Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload
Title source: llmExploitation Summary
CVE-2025-3515 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 5 public exploits from researchers including fuckyourheroes, brokendreamsclub, ImBIOS. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-3515, a file upload vulnerability in the 'Drag and Drop Multiple File Upload for Contact Form 7' WordPress plugin. The exploit demonstrates unauthenticated remote code execution by uploading malicious files with extensions like .phar, .php5, and .inc, which are not properly blacklisted by the plugin.
Description
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.
Exploits (5)
This repository contains a functional exploit for CVE-2025-3515, a file upload vulnerability in the 'Drag and Drop Multiple File Upload for Contact Form 7' WordPress plugin. The exploit demonstrates unauthenticated remote code execution by uploading malicious files with extensions like .phar, .php5, and .inc, which are not properly blacklisted by the plugin.
This repository contains a Python-based exploit for CVE-2025-3515, targeting a file upload vulnerability in the 'Drag and Drop Multiple File Upload for Contact Form 7' WordPress plugin. The exploit automates detection, form identification, and webshell upload using bypass extensions like .phar and .php5.
This repository provides a Dockerized WordPress lab to reproduce CVE-2025-3515, an arbitrary file upload vulnerability in the 'drag-and-drop-multiple-file-upload-contact-form-7' plugin (≤ 1.3.8.9). It includes a Nuclei template to exploit the vulnerability via the `/wp-admin/admin-ajax.php?action=ddmu_upload_file` endpoint.
This repository contains a Python-based exploit for CVE-2025-3515, targeting arbitrary file upload in the 'Drag and Drop Multiple File Upload for Contact Form 7' WordPress plugin. The exploit uploads a malicious PHP shell via an unauthenticated AJAX endpoint, leading to remote code execution.
This repository contains a functional exploit for CVE-2025-3515, a file upload vulnerability in the 'Drag and Drop Multiple File Upload for Contact Form 7' WordPress plugin. The exploit demonstrates unauthenticated remote code execution by uploading malicious files with extensions like .phar and .php5, which are not blacklisted by the plugin.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H