PT-2026-1686 · WordPress · Accessally

Brad Patton · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2020-36875

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AccessAlly versions prior to 3.3.2

Description The AccessAlly WordPress plugin contains a flaw where the login error parameter in the Login Widget is treated as PHP code. This allows a remote attacker to execute arbitrary PHP code within the WordPress web server process, leading to potential remote code execution.

Recommendations Update AccessAlly to version 3.3.2 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2020-36875

Produtos afetados

Accessally

Referências · 5

• 🔥 https://wpscan.com/vulnerability/c644de6d-098d-4889-b75d-53fd2b89ff4d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36875 · Nota de Segurança
• https://vulncheck.com/advisories/accessally-unauthenticated-arbitrary-php-code-execution · Nota
• https://t.me/CVEtracker/41852 · Publicação no Telegram
• https://accessally.com/software-release/accessally-3-3-2 · Correção, Aviso do Fabricante