CVE-2020-36697

The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/unauthenticated-stored-xss-and-content-spoofing-vulnerabilities-in-wordpress-wp-gdpr-plugin-unpatched/Exploit
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-gdpr-multiple-vulnerabilities-2-1-1/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/032e775a-97be-4d93-bac3-094e35be4b11?source=cveThird Party Advisory
• https://blog.nintechnet.com/unauthenticated-stored-xss-and-content-spoofing-vulnerabilities-in-wordpress-wp-gdpr-plugin-unpatched/Exploit
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wp-gdpr-multiple-vulnerabilities-2-1-1/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/032e775a-97be-4d93-bac3-094e35be4b11?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-3669u'Buffer Overflow issue in WLAN tcp ip verification due to u…9.8
• CVE-2020-36691An issue was discovered in the Linux kernel before 5.8. lib/…5.5
• CVE-2020-36692A reflected XSS via POST vulnerability in report scheduler o…5.4
• CVE-2020-36694An issue was discovered in netfilter in the Linux kernel bef…6.7
• CVE-2020-36695Incorrect Default Permissions vulnerability in Hitachi Devic…7.8
• CVE-2020-36696The Product Input Fields for WooCommerce plugin for WordPres…7.5
• CVE-2020-36698The Security & Malware scan by CleanTalk plugin for WordPres…8.8
• CVE-2020-36699The Quick Page/Post Redirect Plugin for WordPress is vulnera…4.3
• CVE-2020-3670u'Potential out of bounds read while processing downlink NAS…9.1
• CVE-2020-36700The Page Builder: KingComposer plugin for WordPress is vulne…8.8
• CVE-2020-36701The Page Builder: KingComposer plugin for WordPress is vulne…8.8
• CVE-2020-36702The Ultimate Addons for Gutenberg plugin for WordPress is vu…4.3