5M Sites Running WordPress ‘Contact Form 7’ Plugin Open to Attack

A critical unrestricted file upload bug in Contact Form 7 allows an unauthenticated visitor to take over a site running the plugin. As of 18th December 2020 we have patched all hosted sites on our platform against the vulnerability.
Source