CVE-2020-36720

The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities/Exploit
• https://wordpress.org/plugins/kali-forms/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed8e24d-6bd0-4638-9031-997ce2228fad?source=cveBroken Link, Third Party Advisory
• https://blog.nintechnet.com/wordpress-kali-forms-plugin-fixed-multiple-vulnerabilities/Exploit
• https://wordpress.org/plugins/kali-forms/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed8e24d-6bd0-4638-9031-997ce2228fad?source=cveBroken Link, Third Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36714The Brizy plugin for WordPress is vulnerable to authorizatio…8.1
• CVE-2020-36715The Login/Signup Popup plugin for WordPress is vulnerable to…4.6
• CVE-2020-36716The WP Activity Log plugin for WordPress is vulnerable to au…7.3
• CVE-2020-36717The Kali Forms plugin for WordPress is vulnerable to Cross-S…8.8
• CVE-2020-36718The GDPR CCPA Compliance Support plugin for WordPress is vul…9.8
• CVE-2020-36719The ListingPro - WordPress Directory & Listing Theme for Wor…9.8
• CVE-2020-36721The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X…6.5
• CVE-2020-36722The Visual Composer plugin for WordPress is vulnerable to Cr…4.8
• CVE-2020-36723The ListingPro - WordPress Directory & Listing Theme for Wor…5.3
• CVE-2020-36724The Wordable plugin for WordPress is vulnerable to authentic…9.8
• CVE-2020-36725The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro …8.1
• CVE-2020-36726The Ultimate Reviews plugin for WordPress is vulnerable to P…9.8