5.3.2 Vulnerability

Hi Roman,

The vulnerability only affects forms with file upload enabled. So if your form does not have file fields, it won’t affect you. Regardless, it is recommended to update to the latest version.

[NOTE] While the multipart/form-data body can be sent in the request even though file upload is not enabled, the files do not get saved. We have checked this from our end.

You can find more information about the vulnerability at https://www.getastra.com/blog/911/plugin-exploit/contact-form-7-unrestricted-file-upload-vulnerability/

Thanks, I was wondering the same thing.

A LOT of people have not upgraded to WP 5.4…how about patching WP 4.9x versions like 5.1.9?

Charles

@cpjmooney
Reasonable question.
I have patched manually /includes/formatting.php file.
You can see the changes here: Comparing changes