CVE-2020-35489
CriticalThe contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Published Dec 17, 2020 · Updated Jul 8, 2026 · Also known as c2f54e8d-9e81-4902-9111-b826ef5da164
Key Facts
Patch immediately- CVE-2020-35489 is a critical-severity vulnerability (CVSS 10.0 v3.1) affecting Contact Form 7 (Rocklobster).
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 89% probability of exploitation in the next 30 days.
- Fixed versions are available, including Contact Form 7 5.3.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
89%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-35489 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Contact Form 7Rocklobster | See advisory | 5.3.2 |
Patched Releases
Contact Form 7
5.3.2
Timeline
Publicly disclosed
Dec 17, 2020
Last updated
Jul 8, 2026
Weakness Type
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
- advisoryhttps://contactform7.com/2020/12/17/contact-form-7-532/
- advisoryhttps://wordpress.org/plugins/contact-form-7/#developers
- advisoryhttps://wpscan.com/vulnerability/10508
- advisoryhttps://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload/
- advisoryhttps://www.jinsonvarghese.com/unrestricted-file-upload-in-contact-form-7/
FAQ
Common Questions.
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Affected: Contact Form 7 (Rocklobster). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Contact Form 7 5.3.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-35489 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo