PT-2023-11862 · WordPress · Kali Forms

Jerome Bruandet · CVE-2020-36720 · Publicado 2023-06-07 · Atualizado 2023-06-13

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kali Forms plugin for WordPress versions up to, and including, 2.1.1

Description The issue arises from the update option lacking proper authentication checks, allowing any authenticated attacker to change or delete the plugin's settings. This enables authenticated attackers to modify settings without proper authorization.

Recommendations For versions up to, and including, 2.1.1, update to a version that includes proper authentication checks for the update option to prevent unauthorized changes to the plugin's settings.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2020-36720

Produtos afetados

Kali Forms

Referências · 5

• 🔥 https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities · Exploit
• https://wordfence.com/threat-intel/vulnerabilities/id/9ed8e24d-6bd0-4638-9031-997ce2228fad?source=cve · Nota
• https://osv.dev/vulnerability/CVE-2020-36720 · Aviso do Fabricante
• https://wordpress.org/plugins/kali-forms/#developers · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-36720 · Nota de Segurança