Vulnerability · Published Oct 17, 2022 · Assigned by WPScan
CVE-2022-3282Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Drag and Drop Multiple File Upload – Contact Form 7 from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Drag and Drop Multiple File Upload – Contact Form 7 | 1.3.6.5 – before 1.3.6.5 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N