VulnerabilityModified

CVE-2022-3282

As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.

MEDIUM 4.3EPSS 0.57%

Does this matter?

Lower severity and a low EPSS score (0.57%). Track it; it rarely justifies an emergency change on its own.

Description

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.57% probability · 45th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: codedropz/drag and drop multiple file upload - contact form 7
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/035dffef-4b4b-4afb-9776-7f6c5e56452cExploit, Third Party Advisory
https://wpscan.com/vulnerability/035dffef-4b4b-4afb-9776-7f6c5e56452cExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.