CVE-2020-35489

Critical

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because…

mitre·CWE-434·Published 2020-12-17

CVSS

10.0

EPSS

0.89

KEV

Exploits

cve.orgen

182 chars

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

NVDen

182 chars

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

El plugin contact-form-7 (también se conoce como Contact Form 7) versiones anteriores a 5.3.2 para WordPress, permite una Carga de Archivos Sin Restricciones y una ejecución de código remota porque un nombre de archivo puede contener caracteres especiales

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	10.0	10.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C
3.1	Primary	NVD	10.0	3.9	6.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H