CVE-2025-8464: WordPress File Upload Path Traversal Flaw

CVE-2025-8464 Overview

CVE-2025-8464 is a directory traversal vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress. The flaw affects all versions up to and including 1.3.9.0. The vulnerable component is the wpcf7_guest_user_id cookie, which is used to construct file paths without proper sanitization. Unauthenticated attackers can traverse directories to upload files outside the intended upload directory and delete files within the plugin's uploads folder. The impact is constrained because the plugin validates file types and restricts deletion scope to the plugin's uploads folder. The vulnerability is classified under [CWE-23] Relative Path Traversal.

Critical Impact
Unauthenticated attackers can write validated file types outside the intended directory and delete files within the plugin's uploads folder via cookie-based path traversal.

Affected Products

Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress, versions up to and including 1.3.9.0
WordPress sites using Contact Form 7 with this file upload extension
Any hosting environment exposing the vulnerable plugin endpoint publicly

Discovery Timeline

2025-08-16 - CVE-2025-8464 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8464

Vulnerability Analysis

The plugin uses the wpcf7_guest_user_id cookie value to build per-user upload and cleanup paths on the server. Because the cookie is attacker-controlled and its value is not sanitized against directory traversal sequences, an unauthenticated request carrying a crafted cookie such as ../../ traverses out of the plugin's uploads directory. This allows an attacker to influence where uploaded files are written and which files the plugin targets during deletion routines. The impact is limited by two mitigating controls in the plugin: server-side file-type validation restricts uploads to allowlisted extensions, and deletion logic is scoped to the plugin's uploads folder hierarchy. Combined, these controls prevent full arbitrary file write or arbitrary file delete, but attackers can still place validated content in unexpected locations and remove other users' uploaded submissions.

Root Cause

The root cause is unsanitized use of a client-supplied cookie value as part of a filesystem path. The relevant handlers referenced in the plugin source at lines 77, 1018, and 1050 of inc/dnd-upload-cf7.php construct paths that incorporate wpcf7_guest_user_id without normalizing the value or rejecting relative path segments. This maps directly to [CWE-23] Relative Path Traversal.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the plugin's upload or delete endpoint with a crafted wpcf7_guest_user_id cookie containing traversal sequences. The request requires no user interaction and no privileges. The attacker cannot upload executable PHP because file-type validation blocks unsafe extensions, but they can place validated file types at attacker-chosen relative locations and delete files inside the plugin's uploads folder. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical references.

Detection Methods for CVE-2025-8464

Indicators of Compromise

HTTP requests to the plugin's upload endpoint containing wpcf7_guest_user_id cookie values with ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
Files appearing in WordPress upload directories outside the expected dnd-upload-cf7 subfolder path
Unexpected deletions of previously submitted attachments within the plugin's uploads folder
Web server access logs showing repeated POST requests from a single IP with anomalous cookie headers

Detection Strategies

Inspect HTTP request headers on admin-ajax.php and plugin endpoints for path traversal patterns in the wpcf7_guest_user_id cookie
Correlate file creation events in wp-content/uploads with the source HTTP request cookie values
Alert on file writes to WordPress upload subdirectories that do not match the plugin's expected path convention

Monitoring Recommendations

Enable WordPress plugin file integrity monitoring across the wp-content/uploads tree
Forward web server access logs to a centralized log store with detection rules for traversal sequences in cookie headers
Monitor for unauthenticated POST activity spikes against Contact Form 7 endpoints from single sources

How to Mitigate CVE-2025-8464

Immediate Actions Required

Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to a version later than 1.3.9.0 that includes the fix referenced in the plugin changeset
Audit the wp-content/uploads directory for files placed outside the expected dnd-upload-cf7 path
Deploy a Web Application Firewall (WAF) rule to reject requests where the wpcf7_guest_user_id cookie contains path traversal sequences

Patch Information

The vendor released a fix documented in the WordPress Plugin Changeset for the plugin. Administrators should upgrade through the WordPress plugin management interface or via wp-cli. Confirm the installed version is later than 1.3.9.0 after the update completes.

Workarounds

If patching is not immediately possible, disable the Drag and Drop Multiple File Upload for Contact Form 7 plugin until the fixed version can be installed
Configure the WAF or reverse proxy to strip or reject any wpcf7_guest_user_id cookie whose value does not match a strict alphanumeric pattern
Restrict file system permissions on wp-content/uploads to prevent writes outside the plugin's designated subdirectory

bash

# Example WAF rule pattern to block traversal in the vulnerable cookie
# ModSecurity rule
SecRule REQUEST_COOKIES:wpcf7_guest_user_id "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
  "id:1008464,phase:1,deny,status:403,\
   msg:'CVE-2025-8464 traversal attempt in wpcf7_guest_user_id cookie'"