CVE-2023-1112 json
Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal
published 2023-03-01 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-23398
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.0%
- EPSS 3.0% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
Patch / fix
- codedropz drag_and_drop_multiple_file_upload_-_contact_form_7 5.0.6.3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
3.00% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Nickguitar/Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 4.7 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.8 | AV:N/AC:L/Au:M/C:P/I:P/A:P |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- n/a Drag and Drop Multiple File Upload Contact Form 7
Classification
- Weakness
- Technology feeds
References
-
github.com
/Nickguitar/Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal
exploit, third-party-advisory
-
vuldb.com
/?id.222072
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.222072
signature, permissions-required, third-party-advisory
Sources
- CVE List CVE-2023-1112
- NVD CVE-2023-1112
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.