CVE-2020-36730
HIGHCMP by NiteoThemes <= 3.8.1 - Unauthenticated Authorization Bypass
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-36730. PoCs published by RandomRobbieBF.
AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2020-36730, which targets improper access controls in the CMP - Coming Soon & Maintenance WordPress plugin. The script checks the plugin version, logs into WordPress, and exploits the vulnerability to export subscriber data via an unauthorized AJAX call.
Description
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.
Exploits (1)
The repository contains a functional Python exploit for CVE-2020-36730, which targets improper access controls in the CMP - Coming Soon & Maintenance WordPress plugin. The script checks the plugin version, logs into WordPress, and exploits the vulnerability to export subscriber data via an unauthorized AJAX call.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L