CVE-2020-35489

The Contact Form 7 plugin through version 5.3.2 contains a vulnerability allowing unauthorized file uploads due to improper validation of filenames that include special characters, which could bypass file extension restrictions under specific server configurations. While the vulnerability's practical exploitation appears difficult and requires particular environmental conditions or configuration settings, the flaw theoretically enables attackers to upload arbitrary files to affected WordPress installations.

Based on public CVE data (MITRE/NVD).