CVE-2025-3515 is a high severity flaw (CVSS 8.1) in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. In versions up to and including 1.3.8.9, unauthenticated visitors can bypass the file type blacklist and upload dangerous files such as .phar. Update to a release newer than 1.3.8.9.
What's affected
The record says all versions up to and including 1.3.8.9 are affected. It points to the plugin's upload handler and to a changeset in the WordPress plugin repository. The record does not name the first fixed version, so check the Wordfence entry or the plugin changelog. The public plugin page lists a newer release.
Remote code execution is described as possible only on servers set up to run .phar files as PHP. The record names default Apache with mod_php configurations as a common case where the extension is not strictly checked. Other server setups may be less exposed, but you should not rely on that.
How to check if you're exposed
With WP-CLI:
wp plugin list --name=drag-and-drop-multiple-file-upload-contact-form-7 --fields=name,status,version
If the version is 1.3.8.9 or lower, update. Also look in the plugin's upload directory under wp-content/uploads for files with unexpected extensions such as .phar or .php. Finding one is a reason to start an incident review. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related advisories.
What to do now
- Back up the site.
- Update the plugin to the latest version from the WordPress directory.
- Review the upload directory for files that are not documents or images, and remove anything you cannot explain after preserving a copy for review.
- Configure the web server so the upload directory cannot execute scripts, and so .phar is not handled as PHP.
- If you find suspicious files, rotate WordPress credentials and database passwords and check for new admin users.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The plugin used a blacklist of bad extensions, which is a fragile design because the list always misses something. An allowlist of the types you actually want is safer.
Contact forms are public by nature, so an upload feature on one is open to anyone. The score is high and not critical because code execution depends on the server configuration. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not report exploitation.
Quick check
Do I have to remove the plugin?
No. Updating to a fixed version addresses the flaw. Remove it only if you no longer need file uploads on your forms.
Does disabling PHP in the upload folder help?
It reduces the impact of this class of bug, as the record notes that execution depends on server configuration. You should still update.
Sources
- Plugin upload handler in the WordPress repository
- Wordfence entry for CVE-2025-3515
- Plugin page on WordPress.org
Last reviewed: 18 October 2026.
