CVE-2020-36720highexplotación observadaCWE-862

CVE-2020-36720: fallo de gravedad alta en wpchill Kali Forms — Contact Form &…

Kali Forms <= 2.1.1 - Missing Authorization to Settings Update

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Kali Forms — Contact Form & Drag-and-Drop Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 7.1epss 0.8%
de la publicación al arma
Publicada en NVD7 jun
VulnCheck21 ago
The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Productos afectados
wpchill · Kali Forms — Contact Form & Drag-and-Drop Builder
CVEs relacionadas — wpchill Kali Forms — Contact Form &…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-3584CRITICALKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_processEPSS 7.4%CVE-2026-16144HIGHKali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field ParameterEPSS 1.2%CVE-2020-36712HIGHKali Forms <= 2.1.1 - Unauthenticated Arbitrary Post DeletionEPSS 0.7%CVE-2020-36717HIGHKali Forms <= 2.1.1 - Cross-Site Request ForgeryEPSS 0.5%CVE-2026-15395HIGHKali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field ValueEPSS 0.4%CVE-2026-9107MEDIUMKali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' ParameterEPSS 0.4%