CVE-2024-12267
Published: 31 January 2025
Summary
CVE-2024-12267 is a medium-severity External Control of File Name or Path (CWE-73) vulnerability in Codedropz Drag And Drop Multiple File Upload - Contact Form 7. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-14 (Public Access Protections) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-12267 affects the Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress, impacting all versions up to and including 1.3.8.5. The vulnerability stems from insufficient file path validation in the dnd_codedropz_upload_delete() function, enabling limited arbitrary file deletion. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and is associated with CWE-73 (External Control of File Name or Path).
Unauthenticated attackers can exploit this issue remotely with low complexity and no privileges required. Successful exploitation allows deletion of limited arbitrary files on the server, though critical files such as wp-config.php cannot be targeted, preventing escalation to remote code execution.
Advisories reference a patch in the plugin's Trac changeset 3231973, which updates the dnd-upload-cf7.php file to address the validation flaw. Wordfence threat intelligence provides further details on the vulnerability at their dedicated page.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50731
Vulnerability details
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This…
more
makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public-facing WordPress plugin (T1190) resulting in arbitrary file deletion capability (T1070.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the insufficient file path validation in the dnd_codedropz_upload_delete() function by requiring input validation mechanisms at system entry points.
Ensures timely remediation of the specific flaw through identification, testing, and patching as provided in the plugin's Trac changeset 3231973.
Protects against unauthorized file deletion via public interfaces exploited by unauthenticated remote attackers in this vulnerability.