CVE-2020-35489
published 2020-12-17CVE-2020-35489: The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may…
PriorityP279critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
89.63%
99.8th percentile
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rocklobster | contact_form_7 | < 5.3.2 | 5.3.2 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://contactform7.com/2020/12/17/contact-form-7-532/https://wordpress.org/plugins/contact-form-7/#developershttps://wpscan.com/vulnerability/10508https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload/https://www.jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7/https://contactform7.com/2020/12/17/contact-form-7-532/https://wordpress.org/plugins/contact-form-7/#developershttps://wpscan.com/vulnerability/10508https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload/https://www.jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7/
2020-12-17
Published