CVE-2020-36730
Summary
| CVE | CVE-2020-36730 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-06-07 02:15:00 UTC |
| Updated | 2023-11-07 03:22:00 UTC |
| Description | The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin. |
Risk And Classification
Problem Types: CWE-862
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Niteothemes | Cmp | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| WordPress Plugin CMP-Coming Soon & Maintenance by NiteoThemes Security Bypass (3.8.1) - Vulnerabilities - Acunetix | MISC | www.acunetix.com | |
| Just a moment... | MISC | wpscan.com | |
| Multiple vulnerabilities fixed in CMP – Coming Soon and Maintenance plugin. – NinTechNet | MISC | blog.nintechnet.com | |
| CMP <= 3.8.1 - Missing Authorization | MISC | www.wordfence.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.