CVE-2020-36720highexploração observadaCWE-862

CVE-2020-36720: falha de alta gravidade em wpchill Kali Forms — Contact Form &…

Kali Forms <= 2.1.1 - Missing Authorization to Settings Update

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Kali Forms — Contact Form & Drag-and-Drop Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

43Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 7.1epss 0.8%
da publicação à arma
Publicada no NVD7 de jun.
VulnCheck21 de ago.
The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
wpchill · Kali Forms — Contact Form & Drag-and-Drop Builder
CVEs relacionadas — wpchill Kali Forms — Contact Form &…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-3584CRITICALKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_processEPSS 7.4%CVE-2026-16144HIGHKali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field ParameterEPSS 1.2%CVE-2020-36712HIGHKali Forms <= 2.1.1 - Unauthenticated Arbitrary Post DeletionEPSS 0.7%CVE-2020-36717HIGHKali Forms <= 2.1.1 - Cross-Site Request ForgeryEPSS 0.5%CVE-2026-15395HIGHKali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field ValueEPSS 0.4%CVE-2026-9107MEDIUMKali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' ParameterEPSS 0.4%