CVE-2020-35489 – Contact Form 7: Critical Remote Code Execution

CVE-2020-35489 is an unrestricted file upload vulnerability in the Contact Form 7 plugin for WordPress, widely used on websites with contact forms. A flaw in validating special characters in filenames allows remote code execution on the server. The risk is extreme for administrators who have not updated the plugin: total WordPress platform compromise.

The vulnerability is classified critical with CVSS 10.0, the maximum score. The National Vulnerability Database (NVD) reported the flaw on December 17, 2020. Public GitHub repositories declare they contain exploits for this CVE; recent activity (November 2026) on these repositories confirms the risk is still being actively exploited. Unpatched sites remain exposed.

Defenders must act immediately: check the Contact Form 7 version installed in the WordPress backend, update to 5.3.2 or later, and review access logs for suspicious uploads. If the site has been compromised, isolate it from the network, audit unauthorized files, and reset all administrator credentials. Do not download plugins from unknown sources: use only the official WordPress repository.