Contact Form Submissions <= 1.6.4 - Authenticated Double Query SQL injection

The plugin is affected by a double query SQL injection, which could allow high privileged users to access data from the DBMS. Edit WPScanTeam October 26th, 2020 - Confirmed & Escalated to WP October 27th, 2020 - WP Investigating January 3rd, 2021 - No updates, disclosing PoC The PoC will be...

WordPress Contact Form Submissions plugin <= 1.7 - Authenticated Double Query SQL injection (SQLi) vulnerability

Authenticated Double Query SQL injection SQLi vulnerability found by Lenon Leite in WordPress Contact Form Submissions plugin versions = 1.7. Solution Update the WordPress Contact Form Submissions plugin to the latest available version at least 1.7.1...

WordPress Contact Form Submissions plugin <= 1.7 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Sun research team in WordPress Contact Form Submissions plugin versions = 1.7. Solution Update the WordPress Contact Form Submissions plugin to the latest available version at least 1.7.1...

Contact Form Submissions <= 1.6.4 - Authenticated SQL Injection

The wpcf7contactform GET parameter is vulnerable to SQL injection when submitting a filter request as a high privilege user admin+ Edit WPScanTeam September 28th, 2020 - Escalated to WP & WP Investigating October 26th, 2020 - Received another submission related a SQL injection in the same paramet...

Contact Form Submissions <= 1.6.4 - Authenticated SQL Injection

The wpcf7contactform GET parameter is vulnerable to SQL injection when submitting a filter request as a high privilege user admin+ Edit WPScanTeam September 28th, 2020 - Escalated to WP & WP Investigating October 26th, 2020 - Received another submission related a SQL injection in the same paramet...

Exploit for Unrestricted Upload of File with Dangerous Type in Rocklobster Contact_Form_7

Check-WP-CVE-2020-35489 CVE-2020-35489 The CVE-2020-35489...

WordPress Contact Form 7 Plugin < 5.3.2 RCE Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rocklobster:contactform7"; if description...

Wordpress Plugin Contact Form 7 5.3.1 - Unrestricted File Upload

Exploit Title: Wordpress Plugin Contact Form 7 5.3.1 - Unrestricted File Upload Date: 12/20/2020 Exploit Author: Ramón Vila Ferreres @ramonvfer Vendor Homepage: https://contactform7.com Software Link: https://wordpress.org/plugins/contact-form-7/ Version: 5.3.1 and below Tested on: Windows 10 190...

5M WordPress Sites Running 'Contact Form 7' Plugin Open to Attack

A patch for the popular WordPress plugin called Contact Form 7 was released Thursday. It fixes a critical bug that allows an unauthenticated adversary to takeover a website running the plugin or possibly hijack the entire server hosting the site. The patch comes in the form of a 5.3.2 version...

CVE-2020-35489

The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...

CVE-2020-35489

The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...

Unrestricted file upload

The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...

CVE-2020-35489

The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...

CVE-2020-35489

The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...

CVE-2020-35489

Summary (CVE-2020-35489): The WordPress plugin Contact Form 7 (before 5.3.2) is vulnerable to an unrestricted file upload leading to remote code execution because a filename can contain special characters. Affected product: WordPress Contact Form 7 plugin; affected version range: prior to 5.3.2. ...

Contact Form 7 < 5.3.2 - Unrestricted File Upload

The popular WordPress plugin, Contact Form 7 was found to be vulnerable to Unrestricted File Upload. PoC Append a unicode special character from U+0000 null to U+001F us to a filename and upload it via the ContactForm7 upload feature...

Wordpress contact-form-7 代码问题漏洞

Wordpress contact-form-7 is a Wordpress Foundation plugin that provides forms for Wordpress. A security vulnerability exists in contact-form-7 aka Contact Form 7 plugin prior to version 5.3.2 that allows unrestricted file uploads and remote code execution because file names may contain special...

PT-2020-6885

Name of the Vulnerable Software and Affected Versions Contact Form 7 versions prior to 5.3.2 Description The issue is related to an Unrestricted File Upload vulnerability in the Contact Form 7 plugin for WordPress, which can lead to remote code execution. This is because a filename may contain...

CVE-2020-35489: Unrestricted Upload of File with Dangerous Type

The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...

Contact Form 7 < 5.3.2 - Unrestricted File Upload

The popular WordPress plugin, Contact Form 7 was found to be vulnerable to Unrestricted File Upload. Append a unicode special character from U+0000 null to U+001F us to a filename and upload it via the ContactForm7 upload feature...