CVE-2024-3717 is a medium severity vulnerability (CVSS 5.3) in Drag and Drop Multiple File Upload for Contact Form 7. Uploaded files are kept in a web accessible folder, so unauthenticated visitors can extract data submitted through a form. The record lists a plugin changeset and a Wordfence entry in its references but does not state a patched version number.
What's affected
- The WordPress plugin Drag and Drop Multiple File Upload for Contact Form 7, all versions up to and including 1.3.7.7.
Severity in the record: Medium, CVSS 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. In plain terms: over the network, no privileges required, no user interaction. Weakness class: CWE-922, insecure storage of sensitive information.
Fixed version: The record lists a plugin changeset and a Wordfence entry in its references but does not state a patched version number. Update to the newest release and confirm the fixed version on the Wordfence entry.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- List installed plugins and versions with WP-CLI:
wp plugin list. - Check the folder on disk:
ls wp-content/uploads/wp_dndcf7_uploads/. - Test from outside your network whether the folder path returns a directory listing or files.
What to do now
- Update the plugin to the latest release.
- Block direct web access to the upload folder at the web server level.
- Review what files have accumulated in the folder and delete what you no longer need.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3717.
Why it matters
Files that users submit through a form can hold personal or confidential data. If the plugin saves them in a folder the web server lists or serves directly, anyone who finds the path can fetch them without signing in. Uploads should go to a location that is not directly served, or sit behind an access check.
The exposed path is under wp-content/uploads, in a folder named wp_dndcf7_uploads. Forms that accept documents tend to collect exactly the files people consider private, such as CVs, IDs and medical letters. Even after you patch, files already in that folder may have been fetched, so clear out what you no longer need.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need a login to exploit it?
No. The record says unauthenticated attackers can extract data uploaded through a form, which is why the CVSS vector needs no privileges.
Is CVE-2024-3717 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
