CVE-2020-35489

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1190%

EPSS Percentile13.26th

Published2020年12月17日

Last Modified2024年11月21日

Vulnerability Description

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

Affected Platforms (CPE)

📦

Rocklobster

Contact Form 7

< 5.3.2

References & Advisories

🔗 https://contactform7.com/2020/12/17/contact-form-7-532/

🔗 https://wordpress.org/plugins/contact-form-7/#developers

🔗 https://wpscan.com/vulnerability/10508

🔗 https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload/

🔗 https://www.jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7/