CVE-2025-3515 PoC — WordPress plugin Drag and Drop Multiple File Upload for Contact Form 代码问题漏洞

Description

CVE‑2025‑3515 — Drag and Drop Multiple File Upload for Contact Form 7

介绍

# CVE-2025-3515
CVE‑2025‑3515 — Drag and Drop Multiple File Upload for Contact Form 7

- **Description:** Arbitrary file uploads via `drag‑and‑drop‑multiple‑file‑upload-contact‑form‑7` ≤1.3.8.9 allow upload of `.phar` files, leading to remote code execution in Apache+mod_php :contentReference[oaicite:29]{index=29}.  
- **CVSS (v3.1):** 8.1 (High) :contentReference[oaicite:30]{index=30}  
- **Patch:** Updated to ≥1.3.9.0 :contentReference[oaicite:31]{index=31}  
- **References:**
  - NVD: CVE‑2025‑3515 :contentReference[oaicite:32]{index=32}  
  - Wiz, feedly, GitHub advisory, Wordfence, WordPress Trac links above

The tool coded in python version 3 use checker for detect the existing plugin then use the exploit 
Telegram: https://t.me/Professor6T9
Team Telegram: https://t.me/TeamAnonForce6T9

文件快照

备注