UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2020-35489

Contact Form 7: Unrestricted Upload of File with Dangerous Type

Severity
Critical 10.0
Published
17 Dec 2020
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
5.3.2
Also known as
WPV-69f4e580612c
Sources
NVD, WPVulnerability

Description

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

Affected software

SoftwareAffected versions
Contact Form 7Servers and applications · cpe:a:rocklobster:contact_form_7
  • Every version before 5.3.2
Contact Form 7WordPress plugins · wp-plugin:contact-form-7
  • Every version before 5.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-35489
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-35489
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contact-form-7/contact-form-7-531-arbitrary-file-upload-via-bypass