CVE-2020-36712

The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to delete any site post or page with the id parameter.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities/Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92644676-add4-415c-9a1a-c6616108688d?source=cveThird Party Advisory
• https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities/Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92644676-add4-415c-9a1a-c6616108688d?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36707The Coming Soon & Maintenance Mode Page plugin for WordPress…8.8
• CVE-2020-36708The following themes for WordPress are vulnerable to Functio…9.8
• CVE-2020-36709The Page Builder: KingComposer plugin for WordPress is vulne…4.8
• CVE-2020-3671Use-after-free issue could occur due to dangling pointer whe…9.8
• CVE-2020-36710The WPS Hide Login plugin for WordPress is vulnerable to log…7.5
• CVE-2020-36711The Avada theme for WordPress is vulnerable to Stored Cross-…5.4
• CVE-2020-36713The MStore API plugin for WordPress is vulnerable to authent…9.8
• CVE-2020-36714The Brizy plugin for WordPress is vulnerable to authorizatio…8.1
• CVE-2020-36715The Login/Signup Popup plugin for WordPress is vulnerable to…4.6
• CVE-2020-36716The WP Activity Log plugin for WordPress is vulnerable to au…7.3
• CVE-2020-36717The Kali Forms plugin for WordPress is vulnerable to Cross-S…8.8
• CVE-2020-36718The GDPR CCPA Compliance Support plugin for WordPress is vul…9.8