CVE-2020-36724

The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hash_hmac() function and the use of a loose comparison on the hash which allows an attacker to trick the function into thinking it has a valid hash. This makes it possible for unauthenticated attackers to gain administrator privileges.

• CWE-288
• CWE-306

• https://blog.nintechnet.com/wordpress-plugins-and-themes-vulnerabilities-roundup/Exploit
• https://plugins.trac.wordpress.org/changeset/2234193/wordable/trunk/wordable.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/be1ab218-37bd-407a-8cb9-66f761849c21?source=cveThird Party Advisory
• https://blog.nintechnet.com/wordpress-plugins-and-themes-vulnerabilities-roundup/Exploit
• https://plugins.trac.wordpress.org/changeset/2234193/wordable/trunk/wordable.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/be1ab218-37bd-407a-8cb9-66f761849c21?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36718The GDPR CCPA Compliance Support plugin for WordPress is vul…9.8
• CVE-2020-36719The ListingPro - WordPress Directory & Listing Theme for Wor…9.8
• CVE-2020-36720The Kali Forms plugin for WordPress is vulnerable to Authent…7.1
• CVE-2020-36721The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X…6.5
• CVE-2020-36722The Visual Composer plugin for WordPress is vulnerable to Cr…4.8
• CVE-2020-36723The ListingPro - WordPress Directory & Listing Theme for Wor…5.3
• CVE-2020-36725The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro …8.1
• CVE-2020-36726The Ultimate Reviews plugin for WordPress is vulnerable to P…9.8
• CVE-2020-36727The Newsletter Manager plugin for WordPress is vulnerable to…9.8
• CVE-2020-36728The Adning Advertising plugin for WordPress is vulnerable to…9.8
• CVE-2020-36729The 2J-SlideShow Plugin for WordPress is vulnerable to autho…4.3
• CVE-2020-3673u'Buffer overflow can happen as part of SIP message packet p…9.8