CVE-2025-3515 WordPress Lab (Drag and Drop Multiple File Upload for Contact Form 7)

Spin up a vulnerable WordPress environment to reproduce and validate CVE-2025-3515 — unrestricted file upload via ddmu_upload_file in the plugin drag-and-drop-multiple-file-upload-contact-form-7 (≤ 1.3.8.9). This lab is Dockerized for quick, deterministic testing with Nuclei.

• Vulnerable plugin: drag-and-drop-multiple-file-upload-contact-form-7 v1.3.8.9
• Core dependency: Contact Form 7 (auto-installed)
• Endpoint of interest: /wp-admin/admin-ajax.php?action=ddmu_upload_file

Quickstart

1. Start the lab

docker compose up -d

1. Wait 15-45s for init. Confirm WP is reachable:

curl -I http://localhost:8080/wp-login.php | head -n1

1. Run the Nuclei PoC template from repo root

nuclei -u http://localhost:8080 -t http/cves/2025/CVE-2025-3515.yaml -vv -debug

Containerized alternative (uses the same docker network):

docker run --rm --network lab-cve-2025-3515_default \
  -v "$(pwd)":/workspace \
  projectdiscovery/nuclei:latest \
  -u http://wordpress \
  -t /workspace/http/cves/2025/CVE-2025-3515.yaml -vv -debug

Credentials

• WP Admin: admin / admin

Notes

• This lab demonstrates arbitrary file upload and code execution under Apache + mod_php style containers. The included Nuclei template uploads a short PHP payload that self-deletes after echoing a marker for verification.
• For safety, only run against local or authorized targets.

Tags / Topics

wordpress, contact-form-7, drag-and-drop-multiple-file-upload-contact-form-7, ddmu_upload_file, arbitrary file upload, rce, nuclei, docker lab, security research, CVE-2025-3515