CVE-2020-36852

CRITICAL EXPLOITED

WordPress Custom Searchable Data Entry System <1.7.1 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-36852 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazale_sds_delete_entries_table_row() function. This makes it possible for unauthenticated attackers to completely wipe database tables such as wp_users.

References (2)

Core 2

Scores

CVSS v3 9.1
EPSS 0.0031
EPSS Percentile 22.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2020-03-06
CWE
CWE-862
Status published
Products (1)
ghazale/Custom Searchable Data Entry System < 1.7.1
Published Oct 01, 2025
Tracked Since Feb 18, 2026