WordPress Plugin Vulnerabilities

Simple:Press < 6.6.1 - Broken Access Control leading to RCE

Description

Jerome Bruandet, from NinTechNet, discovered a broken access control issue in the plugin, which could lead to unauthenticated arbitrary file and RCE.

Affects Plugins

Plugin icon
simplepress
Fixed in 6.6.1

References

CVE
CVE-2020-36706
URL
https://blog.nintechnet.com/wordpress-simplepress-plugin-fixed-critical-vulnerabilities/

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
10.0 (critical)

Miscellaneous

Original Researcher
Jerome Bruandet (NinTechNet)
Verified
No
WPVDB ID
27d4a8a5-9d81-4b42-92be-3f7d1ef22843

Timeline

Publicly Published
2020-09-25 (about 3 years ago)
Added
2020-09-25 (about 3 years ago)
Last Updated
2023-11-03 (about 6 months ago)

Other

Published
Title
Published
2019-08-09
Title
Woody Ad Snippets < 2.2.6 - Arbitrary Post Deletion
Published
2021-12-06
Title
Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls
Published
2024-03-22
Title
WooCommerce Clover Payment Gateway < 1.3.2 - Missing Authorization via callback_handler
Published
2021-05-07
Title
Leads-5050 Visitor Insights < 1.1.0 - Unauthorised License Change
Published
2020-12-14
Title
Total Upkeep by BoldGrid < 1.14.10 - Sensitive Data Disclosure (Server IP Address, UID etc)