The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings.
References
Configurations
History
21 Nov 2024, 05:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.nintechnet.com/unauthenticated-stored-xss-and-content-spoofing-vulnerabilities-in-wordpress-wp-gdpr-plugin-unpatched/ - Exploit | |
| References | () https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-gdpr-multiple-vulnerabilities-2-1-1/ - Third Party Advisory | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/032e775a-97be-4d93-bac3-094e35be4b11?source=cve - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
12 Jun 2023, 17:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Appsaloon wp Gdpr
Appsaloon |
|
| CWE | CWE-862 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/032e775a-97be-4d93-bac3-094e35be4b11?source=cve - Third Party Advisory | |
| References | (MISC) https://blog.nintechnet.com/unauthenticated-stored-xss-and-content-spoofing-vulnerabilities-in-wordpress-wp-gdpr-plugin-unpatched/ - Exploit | |
| References | (MISC) https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-gdpr-multiple-vulnerabilities-2-1-1/ - Third Party Advisory | |
| CPE | cpe:2.3:a:appsaloon:wp_gdpr:*:*:*:*:*:wordpress:*:* |
07 Jun 2023, 02:45
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2024-11-21 05:30
NVD link : CVE-2020-36697
Mitre link : CVE-2020-36697
CVE.ORG link : CVE-2020-36697
JSON object : View
Products Affected
appsaloon
- wp_gdpr
CWE
CWE-862
Missing Authorization