CVE-2024-12267 is a medium severity (CVSS 5.3) limited arbitrary file deletion flaw in the Drag and Drop Multiple File Upload plugin for Contact Form 7 on WordPress, up to and including version 1.3.8.5. Unauthenticated visitors can delete some files. Update past 1.3.8.5 or remove the plugin.
What's affected
- Drag and Drop Multiple File Upload for Contact Form 7, all versions up to and including 1.3.8.5.
The record does not state a fixed version. It links a code changeset in the WordPress plugin repository, so a newer release should exist. Check the plugin page for the current version.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i drag-and-drop
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Check for a version above 1.3.8.5 in the WordPress plugin directory and update.
- If your forms do not need drag and drop uploads, switch the feature off or remove the plugin.
- Keep recent backups, since deleted files cannot be recovered from the web server alone.
- Look up CVE-2024-12267 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The weakness sits in the dnd_codedropz_upload_delete() function, which does not validate file paths well enough. The record is explicit that the deletion is limited. It says files such as wp-config.php, whose loss could open the door to code execution, cannot be deleted this way. That is why the score is medium and the impact is rated low on integrity only.
Still, deleting uploads that visitors sent through your contact forms can destroy business records, and a limited bug on a public form is worth closing quickly.
This CVE is a limited arbitrary file deletion flaw (CWE-73, External Control of File Name or Path). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Path validation bugs let a visitor steer a file operation toward a location the developer never intended. Here the operation is deletion, and the check on the supplied path is too weak.
The fix pattern is well known: resolve the path, confirm it stays inside the intended upload folder, and ignore anything else. Tokens or identifiers that map to files on the server side are safer than letting the browser send a path at all.
Quick check
Can this lead to remote code execution?
The record says no. It states that files like wp-config.php cannot be deleted through this flaw.
Does the attacker need an account?
No. The vector shows no privileges required.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
