CVE-2020-35489

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

89.28% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical

Published

2020-12-17

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload/
• Cappricio-Securities/CVE-2020-354892★ · 2024-06-24

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/cve-2020-35489-5041.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2000-0114
• CVE-2009-0347
• CVE-2012-5321
• CVE-2015-1635
• CVE-2015-7297
• CVE-2017-7269