The critical vulnerability ([CVE-2020-35489]) is classified as an unrestricted file upload bug, according to [Astra Security Research, which found the flaw on Wednesday]

Quick Fix

“The plugin developer ([Takayuki Miyoshi] ) was quick to fix the vulnerability, realizing its critical nature. We communicated back and forth trying to release the update as soon as possible to prevent any exploitation. An update fixing the issue has already been released, [in version 5.3.2] ,” according to Astra.

Easy to Exploit

“It is easily exploitable. And the attacker wouldn’t need to be authenticated and the attack can be done remotely,” said Naman Rastogi, digital marketer and growth hacker with Astra, in an email interview with Threatpost.

#wordpress #contact form 7 #wordpress plugin #website running