CVE-2025-53283
Published: 06 November 2025
Summary
CVE-2025-53283 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-53283 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the WordPress plugin Drop Uploader for CF7 - Drag&Drop File Uploader Addon by borisolhor. This issue affects all versions of the plugin from n/a through 2.4.1 and enables attackers to upload a web shell to the web server. The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, no privileges or user interaction required, and changed scope.
Unauthenticated remote attackers can exploit this vulnerability over the network without privileges or user interaction. By leveraging the plugin's drag-and-drop file upload functionality in Contact Form 7 forms, attackers can upload malicious files such as web shells, achieving high impacts on confidentiality, integrity, and availability. This typically results in remote code execution and full compromise of the affected WordPress site.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon/vulnerability/wordpress-drop-uploader-for-cf7-drag-drop-file-uploader-addon-plugin-2-4-1-arbitrary-file-upload-vulnerability?_s_id=cve) documents this arbitrary file upload vulnerability in version 2.4.1. Security practitioners should consult vendor and advisory resources for mitigation guidance, including updating the plugin beyond version 2.4.1 where patches are available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37997
Vulnerability details
Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon:…
more
from n/a through <= 2.4.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated attackers to exploit a public-facing WordPress plugin (T1190) by uploading web shells, directly enabling web shell deployment for persistence and RCE (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unrestricted file upload vulnerability by requiring identification, reporting, and patching of the flawed WordPress plugin.
Enforces validation of file uploads at entry points to reject dangerous types like web shells, comprehensively addressing CWE-434 unrestricted uploads.
Deploys malicious code protection to scan and quarantine web shells during or after upload attempts.