Vulnerability · Published Dec 17, 2020 · Assigned by mitre
CVE-2020-35489
Critical 10.0
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 89.3% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)10.0Critical
Exploit odds (30 days)89.3%top 0.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Affected products (as reported)
References
- https://wordpress.org/plugins/contact-form-7/#developers x_refsource_MISC
- https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload/ x_refsource_MISC
- https://contactform7.com/2020/12/17/contact-form-7-532/ x_refsource_MISC
- https://wpscan.com/vulnerability/10508 x_refsource_MISC
- https://www.jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7/ x_refsource_MISC