.. / CVE-2020-12800

• RCE
• Nuclei
• Web

Exploit for WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution (CVE-2020-12800)

Description:

WordPress Contact Form 7 before 1.3.3.3 allows unrestricted file upload and remote code execution by setting supported_type to php% and uploading a .php% file.

Nuclei Template

View the template here CVE-2020-12800.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-12800.yaml

References: