Dangerous File Type Upload (.phar/.svg) in Drag and Drop Multiple File Upload for Contact Form 7

The plugin’s unauthenticated upload handler does not block .phar and .svg files. An attacker can upload a .phar file, which leads to remote code execution on servers that execute .phar as PHP, or an .svg file carrying stored cross-site scripting.

This vulnerability affects the following application versions:

• Drag and Drop Multiple File Upload for CF7 1.3.3.3.1
• Drag and Drop Multiple File Upload for CF7 1.3.3.3.2
• Drag and Drop Multiple File Upload for CF7 1.3.4
• Drag and Drop Multiple File Upload for CF7 1.3.5
• Drag and Drop Multiple File Upload for CF7 1.3.5.1
• Drag and Drop Multiple File Upload for CF7 1.3.5.4
• Drag and Drop Multiple File Upload for CF7 1.3.5.5.1
• Drag and Drop Multiple File Upload for CF7 1.3.5.7
• Drag and Drop Multiple File Upload for CF7 1.3.5.8
• Drag and Drop Multiple File Upload for CF7 1.3.5.9
• Drag and Drop Multiple File Upload for CF7 1.3.6.1
• Drag and Drop Multiple File Upload for CF7 1.3.6.2
• Drag and Drop Multiple File Upload for CF7 1.3.6.3
• Drag and Drop Multiple File Upload for CF7 1.3.6.4
• Drag and Drop Multiple File Upload for CF7 1.3.6.5
• Drag and Drop Multiple File Upload for CF7 1.3.6.6
• Drag and Drop Multiple File Upload for CF7 1.3.6.7
• Drag and Drop Multiple File Upload for CF7 1.3.6.8
• Drag and Drop Multiple File Upload for CF7 1.3.6.9
• Drag and Drop Multiple File Upload for CF7 1.3.7.1
• Drag and Drop Multiple File Upload for CF7 1.3.7.2
• Drag and Drop Multiple File Upload for CF7 1.3.7.3
• Drag and Drop Multiple File Upload for CF7 1.3.7.4
• Drag and Drop Multiple File Upload for CF7 1.3.7.5
• Drag and Drop Multiple File Upload for CF7 1.3.7.6
• Drag and Drop Multiple File Upload for CF7 1.3.7.7
• Drag and Drop Multiple File Upload for CF7 1.3.7.8
• Drag and Drop Multiple File Upload for CF7 1.3.7.9
• Drag and Drop Multiple File Upload for CF7 1.3.8.0
• Drag and Drop Multiple File Upload for CF7 1.3.8.1
• Drag and Drop Multiple File Upload for CF7 1.3.8.2
• Drag and Drop Multiple File Upload for CF7 1.3.8.3
• Drag and Drop Multiple File Upload for CF7 1.3.8.4
• Drag and Drop Multiple File Upload for CF7 1.3.8.5
• Drag and Drop Multiple File Upload for CF7 1.3.8.6
• Drag and Drop Multiple File Upload for CF7 1.3.8.7
• Drag and Drop Multiple File Upload for CF7 1.3.8.8
• Drag and Drop Multiple File Upload for CF7 1.3.8.9
• Drag and Drop Multiple File Upload for CF7 1.3.9.0
• Drag and Drop Multiple File Upload for CF7 1.3.9.1
• Drag and Drop Multiple File Upload for CF7 1.3.9.2