The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress options, delete arbitrary files/folders, and inject arbitrary content.
Metrics
Affected Vendors & Products
References
History
Mon, 23 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-06-07T01:51:14.187Z
Updated: 2024-12-23T16:22:42.021Z
Reserved: 2023-06-06T12:31:05.300Z
Link: CVE-2020-36700
Vulnrichment
Updated: 2024-08-04T17:37:06.303Z
NVD
Status : Modified
Published: 2023-06-07T02:15:11.127
Modified: 2024-11-21T05:30:06.137
Link: CVE-2020-36700
Redhat
No data.