AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2020-36724

CRITICAL · CVSS 9.8 EPSS 1.54%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2023-06-07 · Last synced 2026-08-04

CyberRota Analysis

This is a critical severity vulnerability with a CVSS score of 9.8. It affects WordPress. Exploitation may require the attacker to be authenticated.

CVE
CVE-2020-36724
Severity
CRITICAL
CVSS
9.8
EPSS
1.54%
WordPress

Original NVD Description

The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hash_hmac() function and the use of a loose comparison on the hash which allows an attacker to trick the function into thinking it has a valid hash. This makes it possible for unauthenticated attackers to gain administrator privileges.