CVE-2020-35489: Contact Form 7 unrestricted file upload enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network reachability, no authentication, and remote code execution impact, combined with a very high EPSS score.

What it is

Contact Form 7 before 5.3.2 for WordPress permits unrestricted file uploads because a filename may contain special characters, allowing an uploaded file to bypass intended restrictions. Because the plugin is widely deployed and the flaw can lead to remote code execution, it is a serious risk for any site running an affected version.

Impact

An unauthenticated attacker can upload a crafted file and achieve remote code execution on the web server, giving full control of the site and its hosting context.

Attack surface

The flaw is reachable over the network through the plugin's file upload functionality, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any site exposing a form with file upload enabled is a candidate.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.8928, 99.77th percentile), indicating strong likelihood of exploitation activity. References are vendor and third-party advisories only, with no public exploit tag in the record.

What to do

• Update Contact Form 7 to 5.3.2 or later immediately.
• If patching is delayed, disable file upload fields in forms or restrict uploads to trusted users.
• Enforce server-side upload validation and block executable file types at the web server.
• Review and harden file upload directories so uploaded files cannot be executed.
• Monitor WordPress plugin versions and apply vendor updates promptly.

Detection

• Inspect web server and upload directory logs for files with unusual or special characters in the filename.
• Alert on newly written files in WordPress upload paths that have executable extensions or unexpected content types.
• Monitor for outbound or child processes spawned by the web server that indicate code execution.
• Check for unexpected files in uploads directories and compare against known legitimate content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.