Authenticated Options Change Flaw in Kali Forms Plugin for WordPress
CVE-2020-36720

7.1HIGH

Key Information:

Vendor

WordPress
Status
Kali Forms — Contact Form & Drag-and-drop Builder
Vendor
CVE Published:
7 June 2023

What is CVE-2020-36720?

The Kali Forms plugin for WordPress is susceptible to an issue allowing authenticated users to change or delete its settings. The vulnerability arises from insufficient authentication checks in the update_option function, affecting versions up to and including 2.1.1. This could lead to unauthorized modifications to critical plugin configurations, potentially compromising the integrity and functionality of the WordPress site.

Affected Version(s)

Kali Forms — Contact Form & Drag-and-Drop Builder 0 < 2.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/wordpress-kali-forms-plugin-f...
https://wordpress.org/plugins/kali-forms/#developers

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.