PT-2025-40063 · WordPress · Custom Searchable Data Entry System

Sean Murphy · Published 2025-10-01 · Updated 2025-10-06 · CVE-2020-36852

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Custom Searchable Data Entry System plugin for WordPress versions up to and including 1.7.1

Description The Custom Searchable Data Entry System plugin for WordPress is susceptible to unauthenticated database wiping. This is due to a missing capability check and insufficient validation within the ghazale sds delete entries table row() function. This allows unauthenticated attackers to completely wipe database tables, such as wp users.

Recommendations Update the Custom Searchable Data Entry System plugin for WordPress to a version newer than 1.7.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-36852

Affected Products

Custom Searchable Data Entry System

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-36852 · Security Note
• https://twitter.com/cracbot/status/1975154116314665030 · Twitter Post
• https://twitter.com/0dayPublishing/status/1973280158829125960 · Twitter Post
• https://twitter.com/CveFindCom/status/1973284358132805989 · Twitter Post
• https://wordfence.com/blog/2020/03/active-attack-on-zero-day-in-custom-searchable-data-entry-system-plugin · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/245d89e5-52cc-44b1-a858-0ca0aacb4e26?source=cve · Note
• https://t.me/cveNotify/137037 · Telegram Post
• https://twitter.com/CVEnew/status/1973285834901389489 · Twitter Post