CVE-2020-36701
Last modified
CVE-2020-36701 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'process_bulk_action' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level permissions and above to upload arbitrary files onto the server which can be used to execute code on the server.. EPSS estimates a 1.53% chance of exploitation in the next 30 days.
Description
The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'process_bulk_action' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level permissions and above to upload arbitrary files onto the server which can be used to execute code on the server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| King-Theme | Page Builder King Composer | <= 2.9.3 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-36701?
How severe is CVE-2020-36701?
How do I fix CVE-2020-36701?
Are you affected by CVE-2020-36701?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST