Drag and Drop Multiple File Upload for Contact Form 7 Security & Risk Analysis

The plugin "drag-and-drop-multiple-file-upload-contact-form-7" v1.3.9.6 presents a mixed security posture. On the positive side, static analysis reveals a strong adherence to secure coding practices in certain areas. The absence of any critical or high severity taint flows, along with the use of prepared statements for all SQL queries and a high percentage of properly escaped output, indicates diligent development in preventing common vulnerabilities like SQL injection and XSS from within the analyzed code. Furthermore, the absence of unprotected AJAX handlers and REST API routes is a significant strength, minimizing the immediate attack surface.

However, the plugin's historical vulnerability record is a major cause for concern. A total of 14 known CVEs, including one critical and seven high severity vulnerabilities, points to a recurring pattern of security weaknesses. The common types of past vulnerabilities such as Missing Authorization, Path Traversal, and Cross-Site Request Forgery suggest systemic issues that have not been fully addressed. While there are currently no unpatched CVEs, the sheer volume and nature of historical issues, combined with the fact that the last vulnerability was dated in the future (2026-03-05), raises questions about the accuracy and completeness of the provided historical data. The presence of 3 nonce checks and 0 capability checks on the entry points is also a concern, as capability checks are crucial for enforcing granular access control.

In conclusion, while the current version shows improvements in some secure coding practices like SQL injection prevention and output escaping, the extensive and severe vulnerability history cannot be ignored. The plugin's past indicates a propensity for critical security flaws, and users should remain vigilant. The lack of capability checks on entry points is a notable weakness that warrants attention. The discrepancy in the last vulnerability date is also an anomaly that requires clarification.