CVE-2020-12800: WordPress drag-and-drop file upload plugin unrestricted upload to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code and very high EPSS make this an urgent patch.

What it is

The drag-and-drop-multiple-file-upload-contact-form-7 plugin for WordPress before 1.3.3.3 fails to restrict uploaded file types, allowing an attacker to set supported_type to php% and upload a .php% file. The uploaded file can then be executed, giving remote code execution on the web server. This is a critical flaw because it is network reachable with no authentication or user interaction required.

Impact

An attacker gains remote code execution on the WordPress host, enabling full compromise of the site, its data and the underlying server.

Attack surface

Reachable over the network through the plugin's file upload endpoint; the CVSS vector shows no privileges and no user interaction required. Any site running the vulnerable plugin version exposes this path.

Exploitation

An exploit is publicly referenced (Packet Storm, tagged Exploit), and EPSS is very high at 0.786 (99.6th percentile), indicating active exploitation is likely. The CVE is not listed in CISA KEV.

What to do

• Update the drag-and-drop-multiple-file-upload-contact-form-7 plugin to 1.3.3.3 or later immediately.
• If patching is not possible, disable or remove the plugin until it can be updated.
• Restrict upload directories so they cannot execute scripts (e.g., disable PHP execution in wp-content/uploads).
• Enforce server-side file type and extension validation independent of client-supplied values.
• Review web server logs for uploads of .php% or similar double-extension files.

Detection

• Search web server and WordPress logs for POST requests to the plugin's upload endpoint containing supported_type=php% or .php% filenames.
• Monitor the uploads directory for newly created files with PHP-like extensions or unusual names.
• Alert on outbound connections or process execution spawned by the web server user.
• Check for unexpected files in wp-content/uploads and compare against known legitimate uploads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.