The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hash_hmac() function and the use of a loose comparison on the hash which allows an attacker to trick the function into thinking it has a valid hash. This makes it possible for unauthenticated attackers to gain administrator privileges.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-06-07T01:51:41.520Z
Updated: 2024-08-04T17:37:06.724Z
Reserved: 2023-06-06T13:16:27.675Z
Link: CVE-2020-36724
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-06-07T02:15:12.487
Modified: 2024-11-21T05:30:10.023
Link: CVE-2020-36724
Redhat
No data.