CVE-2024-12267: Contact Form 7 Path Traversal Vulnerability

CVE-2024-12267 Overview

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress contains a critical arbitrary file deletion vulnerability in the dnd_codedropz_upload_delete() function. This flaw arises from insufficient file path validation, allowing unauthenticated attackers to delete arbitrary files on the server. All versions up to and including 1.3.8.5 are affected by this vulnerability.

While certain critical files like wp-config.php are protected from deletion (preventing direct remote code execution), the vulnerability still poses significant risks to website availability and integrity through the deletion of essential WordPress files, themes, plugins, and uploaded content.

Critical Impact

Unauthenticated attackers can remotely delete arbitrary files on affected WordPress installations, potentially causing denial of service, data loss, and website defacement without requiring any authentication.

Affected Products

• Codedropz Drag and Drop Multiple File Upload – Contact Form 7 versions up to and including 1.3.8.5
• WordPress installations using the affected plugin versions
• All WordPress sites with the vulnerable plugin installed, regardless of Contact Form 7 configuration

Discovery Timeline

• 2025-01-31 - CVE CVE-2024-12267 published to NVD
• 2025-08-11 - Last updated in NVD database

Technical Details for CVE-2024-12267

Vulnerability Analysis

This vulnerability is classified as CWE-73 (External Control of File Name or Path), representing an input validation failure where user-controlled input is used to construct file paths without adequate sanitization. The dnd_codedropz_upload_delete() function fails to properly validate file paths before performing deletion operations.

The vulnerability allows attackers to manipulate file path parameters to traverse directories and target files outside the intended upload directory. Since the vulnerable function is accessible without authentication, any remote attacker can exploit this flaw to delete files on the server.

While the plugin implements some protections that prevent deletion of the core wp-config.php file (which would otherwise enable complete site compromise), many other critical files remain vulnerable. Attackers can still delete essential WordPress core files, plugin files, theme components, database backups, and user-uploaded content.

Root Cause

The root cause of CVE-2024-12267 lies in insufficient file path validation within the dnd_codedropz_upload_delete() function. The function accepts user-supplied input to determine which files to delete but fails to adequately sanitize or validate this input against directory traversal sequences (such as ../) or absolute paths.

This allows attackers to escape the intended upload directory and target files anywhere on the server filesystem where the web server has write permissions. The lack of proper input sanitization combined with missing authentication requirements creates a critical attack surface.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication and no user interaction. An attacker can craft malicious HTTP requests to the vulnerable WordPress endpoint, manipulating the file path parameter to target arbitrary files for deletion.

The attack flow typically involves:

1. Identifying a WordPress site running the vulnerable plugin version
2. Crafting a request to the file deletion endpoint with a manipulated file path
3. Using directory traversal sequences to escape the upload directory
4. Targeting critical application files, backups, or content for deletion

Since no authentication is required, this vulnerability can be exploited by any remote attacker who can reach the WordPress installation over the network.

Detection Methods for CVE-2024-12267

Indicators of Compromise

• Unexpected file deletions in WordPress directories, particularly in wp-content/uploads/, wp-content/plugins/, or wp-content/themes/
• HTTP requests to Contact Form 7 file upload endpoints containing directory traversal patterns (e.g., ../, ..%2f, %2e%2e/)
• Web server logs showing DELETE operations or POST requests with suspicious file path parameters
• Missing WordPress core files, plugin files, or theme components without corresponding legitimate updates

Detection Strategies

• Monitor web server access logs for requests to dnd_codedropz_upload_delete endpoints with unusual parameters
• Implement file integrity monitoring on critical WordPress directories to detect unexpected deletions
• Deploy Web Application Firewall (WAF) rules to detect and block directory traversal attempts in request parameters
• Review PHP error logs for file deletion failures that may indicate exploitation attempts

Monitoring Recommendations

• Enable and centralize logging for all WordPress installations running Contact Form 7 plugins
• Set up alerts for bulk file deletions or deletions outside of maintenance windows
• Monitor for requests containing encoded directory traversal sequences (%2e%2e%2f, %252e%252e%252f)
• Implement baseline monitoring for plugin file counts to detect unexpected removals

How to Mitigate CVE-2024-12267

Immediate Actions Required

• Update the Drag and Drop Multiple File Upload – Contact Form 7 plugin to version 1.3.8.6 or later immediately
• Audit affected WordPress installations for signs of exploitation or unexpected file deletions
• Review web server access logs for suspicious activity targeting Contact Form 7 upload endpoints
• Temporarily disable the plugin if immediate patching is not possible

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix is available in the WordPress Plugin Changeset Update which implements proper file path validation in the dnd_codedropz_upload_delete() function.

Users should update to version 1.3.8.6 or later through the WordPress plugin update mechanism or by downloading directly from the WordPress plugin repository. For detailed vulnerability analysis, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Temporarily deactivate and remove the Drag and Drop Multiple File Upload – Contact Form 7 plugin until patching is possible
• Implement WAF rules to block requests containing directory traversal patterns to Contact Form 7 endpoints
• Restrict access to WordPress admin and plugin endpoints using .htaccess or server configuration
• Enable file system write protection on critical WordPress directories where possible