Analysis Report · Folder Analysis cache/wpcf7-redirect_3.2.7 → cache/wpcf7-redirect_3.2.8 — CVE-2025-14800

Vulnerability Existed: yes
TRUE POSITIVE
Improper Input Validation (Path Traversal) - CWE-22 - classes/class-wpcf7r-save-files.php Lines 181-185

Old Code:
```php
public function move_file_to_upload( $file_path ) {
	global $wp_filesystem;
	$this->filesystem_init();
```

Fixed Code:
```php
public function move_file_to_upload( $file_path ) {

	$validate = wp_check_filetype( $file_path );
	if ( ! $validate['type'] || preg_match( '#^[a-zA-Z0-9+.-]+://#', $file_path ) ) {
		die( esc_html__( 'File type is not allowed', 'wpcf7-redirect' ) );
	}

	global $wp_filesystem;
	$this->filesystem_init();
```

Explanation:
The vulnerability existed because the `move_file_to_upload()` function accepted a `$file_path` parameter without validating it before use. This could allow attackers to:
1. Upload files with disallowed types, potentially executing malicious code
2. Use protocol wrappers (detected by the `#^[a-zA-Z0-9+.-]+://#` regex) to access remote files or special streams

The fix adds validation using `wp_check_filetype()` to ensure the file type is allowed and rejects paths containing protocol schemes (like `php://`, `file://`, `http://`), preventing both arbitrary file type uploads and protocol-based attacks.

---

Vulnerability Existed: not sure
Information Disclosure / Directory Listing - CWE-548 - classes/class-wpcf7r-save-files.php Lines 303-333

Old Code:
```php
}
```

Fixed Code:
```php
}

/**
 * Initializes the index.php file.
 *
 * @param string $dir Upload dir path.
 * @return void
 */
private function init_index_file( $dir ) {
	$index_file    = path_join( $dir, 'index.php' );

	if ( file_exists( $index_file ) ) {
		list( , $second_line_comment ) = (array) file(
			$index_file,
			FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES
		);

		if ( '// Silence is golden.' === $second_line_comment ) {
			return;
		}
	}

	$handle = @fopen( $index_file, 'w' );

	if ( $handle ) {
		fwrite( $handle, "<?php\n" );
		fwrite( $handle, '// Silence is golden.' );

		fclose( $handle );
	}
}
```

Explanation:
This new method creates an `index.php` file in upload directories, a common WordPress security practice to prevent directory listing attacks (CWE-548). The "Silence is golden" comment is a WordPress convention indicating an empty index file meant to block directory traversal. This is a **defensive measure** rather than a fix for an existing vulnerability, as it prevents future directory listing attacks. Uncertainty exists because we cannot confirm if directory listing was previously a problem, but the addition is a legitimate security hardening practice.