CVE-2024-3717: 
WordPress vulnerability analysis and mitigation

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-3717) affecting all versions up to and including 1.3.7.7. The vulnerability exists in the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory, allowing unauthenticated attackers to access sensitive data uploaded through the plugin's form functionality (Wordfence).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited remotely (Network), requires Low attack complexity, needs No privileges, requires No user interaction, has Unchanged scope, with Low impact on confidentiality, and No impact on integrity and availability (NVD).

The vulnerability allows unauthenticated attackers to extract sensitive data that has been uploaded through forms using this plugin. This could potentially expose private information submitted by users through Contact Form 7 forms that utilize the drag and drop file upload functionality (NVD).

The vulnerability is exploitable by unauthenticated attackers who can directly access the exposed directory containing uploaded files. No special privileges or user interaction is required to exploit this vulnerability (NVD).

Users should update their Drag and Drop Multiple File Upload – Contact Form 7 plugin to a version newer than 1.3.7.7 when available. Until then, website administrators should consider restricting access to the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory or temporarily disabling file upload functionality if the feature is not critical (NVD).