WordPress Plugin Vulnerabilities

Contact Form 7 <= 3.5.2 - File Upload Remote Code Execution

Description

The Contact Form 7 WordPress plugin was affected by a File Upload Remote Code Execution security vulnerability.

Affects Plugins

Plugin icon
contact-form-7
Fixed in 3.5.3

References

URL
https://packetstormsecurity.com/files/#124154/

Miscellaneous

Verified
No
WPVDB ID
f307ec17-da98-424f-b784-7cb63351aa8e

Timeline

Publicly Published
2014-08-01 (about 12 years ago)
Added
2014-08-01 (about 12 years ago)
Last Updated
2026-10-05 (about 10 days ago)

Other

Published
Title
Published
2025-09-22
Title
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) < 4.9.56 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'
Published
2026-08-20
Title
Warehouse Cargo <= 2.7.0 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2026-06-10
Title
PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2024-09-12
Title
MStore API – Create Native Android & iOS Apps On The Cloud < 4.15.4 - Authenticated (Subscriber+) Limited Arbitrary File Upload
Published
2023-11-20
Title
WP Child Theme Generator < 1.1.3 - Admin+ Arbitrary File Upload