CVE-2020-36724

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada wordable. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hash_hmac() function and the use of a loose comparison on the hash which allows an attacker to trick the function into thinking it has a valid hash. This makes it possible for unauthenticated attackers to gain administrator privileges.

Rincian

Terbit di NVD

7 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/2234193/wordable/trunk/wordable.php patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/be1ab218-37bd-407a-8cb9-66f761849c21?source=cve advisory pihak ketiga
• https://blog.nintechnet.com/wordpress-plugins-and-themes-vulnerabilities-roundup/ exploit