Unauthenticated Database Wiping in Custom Searchable Data Entry System Plugin for WordPress
CVE-2020-36852
9.1CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 1 October 2025
What is CVE-2020-36852?
The Custom Searchable Data Entry System plugin for WordPress contains a security flaw that allows unauthenticated users to execute database wiping operations. This vulnerability arises from the absence of proper capability checks and insufficient validation in the ghazale_sds_delete_entries_table_row() function. Attackers can exploit this weakness to delete critical database tables, including the wp_users table, potentially resulting in permanent data loss.
Affected Version(s)
Custom Searchable Data Entry System * <= 1.7.1