CVE-2020-7247

Signals

NVD · CVE-2026-7529 · 7.5 · The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of NVD · CVE-2026-7456 · 6.5 · The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function inNVD · CVE-2026-67623 · 8.8 · Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmoNVD · CVE-2026-17506 · 7.2 · The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 9.8 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-7529 · 7.5 · The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of NVD · CVE-2026-7456 · 6.5 · The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function inNVD · CVE-2026-67623 · 8.8 · Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmoNVD · CVE-2026-17506 · 7.2 · The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 9.8 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07

CVE Database · CVE-2020-7247

CVE-2020-7247

· CRITICALAnalyzed

CVSS v3.1

9.8

EPSS

98.95%

Published

Jan 29, 2020

Modified

Nov 7, 2025

CISA Known Exploited Vulnerability

Added: 2022-03-25 · Due: 2022-04-15

Apply updates per vendor instructions.

Public PoC / Exploit (12)

All weaponized →

Exploit-DBOpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)Exploit-DBOpenSMTPD 6.6.1 - Remote Code Execution Exploit-DBOpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution TrickestTrickest PoC index GitHub PoCFiroSolutions/cve-2020-7247-exploit★25 GitHub PoCQTranspose/CVE-2020-7247-exploit★11 GitHub PoCr0lh/CVE-2020-7247★5 GitHub PoCsuperzerosec/cve-2020-7247★4 GitHub PoCf4T1H21/CVE-2020-7247★2 GitHub PoCSimonSchoeni/CVE-2020-7247-POC★2 GitHub PoCpresentdaypresenttime/shai_hulud★2 GitHub PoCminhluannguyen/CVE-2020-7247-reproducer★1

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78CWE-755CWE-755

Affected Products (6)

openbsd · opensmtpdvulnerable

debian · debian_linuxvulnerable

fedoraproject · fedoravulnerable

canonical · ubuntu_linuxvulnerable

References (20)

http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html

ExploitThird Party AdvisoryVDB Entry