The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.
References
Link | Resource |
---|---|
https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities/ | Exploit |
https://wordpress.org/plugins/kali-forms/#developers | Product |
https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed8e24d-6bd0-4638-9031-997ce2228fad?source=cve | Broken Link Third Party Advisory |
Configurations
History
13 Jun 2023, 15:24
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
CPE | cpe:2.3:a:kaliforms:kali_forms:*:*:*:*:*:wordpress:*:* | |
CWE | CWE-862 | |
References | (MISC) https://wordpress.org/plugins/kali-forms/#developers - Product | |
References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed8e24d-6bd0-4638-9031-997ce2228fad?source=cve - Broken Link, Third Party Advisory | |
References | (MISC) https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities/ - Exploit |
07 Jun 2023, 02:45
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2024-02-04 23:37
NVD link : CVE-2020-36720
Mitre link : CVE-2020-36720
CVE.ORG link : CVE-2020-36720
JSON object : View
Products Affected
kaliforms
- kali_forms
CWE
CWE-862
Missing Authorization