PT-2026-1686 · WordPress · Accessally

Brad Patton · Published 2026-01-09 · Updated 2026-01-09 · CVE-2020-36875

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AccessAlly versions prior to 3.3.2

Description The AccessAlly WordPress plugin contains a flaw where the login error parameter in the Login Widget is treated as PHP code. This allows a remote attacker to execute arbitrary PHP code within the WordPress web server process, leading to potential remote code execution.

Recommendations Update AccessAlly to version 3.3.2 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-36875

Affected Products

Accessally

References · 5

• 🔥 https://wpscan.com/vulnerability/c644de6d-098d-4889-b75d-53fd2b89ff4d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36875 · Security Note
• https://vulncheck.com/advisories/accessally-unauthenticated-arbitrary-php-code-execution · Note
• https://t.me/CVEtracker/41852 · Telegram Post
• https://accessally.com/software-release/accessally-3-3-2 · Patch, Vendor Advisory