Description
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
dn9uy3n/Check-WP-CVE-2020-35489 ★ 32 · Dec 24, 2020
The (WordPress) website test script can be exploited for Unlimited File Upload via CVE-2020-35489
-
reneoliveirajr/wp_CVE-2020-35489_checker ★ 13 · May 31, 2023
WordPress Sites Vulnerability Checker for CVE-2020-35489 - "Educational Use Only"
-
Cappricio-Securities/CVE-2020-35489 ★ 2 · May 19, 2024
WordPress Contact Form 7 - Unrestricted File Upload
-
X0UCYB3R/Check-WP-CVE-2020-35489 ★ 2 · Apr 22, 2021
-
elabod1/SOC-wordpress-compromise-report ★ 1 · Nov 7, 2026
Incident report: WordPress compromise via Simple File List RCE (CVE-2020-35489)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://wordpress.org/plugins/contact-form-7/#developers
- https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload/
- https://contactform7.com/2020/12/17/contact-form-7-532/
- https://wpscan.com/vulnerability/10508
- https://www.jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7/