CVE-2020-35489

CRITICAL 10.0CVE-2020-35489 · Published 17/12/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
contact form 7 rocklobster	`< 5.3.2`	`5.3.2`

Description

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

References

contactform7.com/2020/12/17/contact-form-7-532 · Vendor Advisory
wordpress.org/plugins/contact-form-7 · Release Notes
wpscan.com/vulnerability/10508 · Third Party Advisory
getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload · Third Party Advisory
jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free