PT-2025-40063 · WordPress · Custom Searchable Data Entry System

Sean Murphy · Publicado 2025-10-01 · Atualizado 2025-10-06 · CVE-2020-36852

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Custom Searchable Data Entry System plugin for WordPress versions up to and including 1.7.1

Description The Custom Searchable Data Entry System plugin for WordPress is susceptible to unauthenticated database wiping. This is due to a missing capability check and insufficient validation within the ghazale sds delete entries table row() function. This allows unauthenticated attackers to completely wipe database tables, such as wp users.

Recommendations Update the Custom Searchable Data Entry System plugin for WordPress to a version newer than 1.7.1.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2020-36852

Produtos afetados

Custom Searchable Data Entry System

Referências · 8

• https://twitter.com/cracbot/status/1975154116314665030 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/1973280158829125960 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2020-36852 · Nota de Segurança
• https://twitter.com/CveFindCom/status/1973284358132805989 · Publicação no Twitter
• https://wordfence.com/blog/2020/03/active-attack-on-zero-day-in-custom-searchable-data-entry-system-plugin · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/245d89e5-52cc-44b1-a858-0ca0aacb4e26?source=cve · Nota
• https://t.me/cveNotify/137037 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1973285834901389489 · Publicação no Twitter