CVE-2020-35489

CVE-2020-35489 is a critical unrestricted file upload vulnerability affecting the Contact Form 7 plugin for WordPress, versions prior to 5.3.2. This flaw allows remote code execution due to the plugin's failure to properly sanitize filenames containing special characters. With a CVSS score of 10.0, it presents a severe risk, enabling unauthenticated attackers to compromise confidentiality, integrity, and availability of affected systems with low attack complexity. While there is no evidence of active exploitation in the wild or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media attention, indicating its potential for future exploitation.