CVE-2020-36505

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Delete All Comments Easily	>= 1.3, <= 1.3

References

https://medium.com/%40hoanhp/0-day-story-2-delete-all-comments-easily-a854e52a7d50
https://wpscan.com/vulnerability/239f8efa-8fa4-4274-904f-708e65083821Exploit, Third Party Advisory
https://medium.com/%40hoanhp/0-day-story-2-delete-all-comments-easily-a854e52a7d50
https://wpscan.com/vulnerability/239f8efa-8fa4-4274-904f-708e65083821Exploit, Third Party Advisory

Timeline

Published: Nov 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-36517.5Active command timeout since WM status change cmd is not removed from active queue if peer sends multiple deauth frames. in Snapdragon Auto,CVE-2020-365106.1The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s CVE-2020-365117.5An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialize CVE-2020-365129.8An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locatio CVE-2020-365139.8An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.CVE-2020-365149.8An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations.CVE-2020-365165.9An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy all CVE-2020-365177.5An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowled CVE-2020-365187.5jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.CVE-2020-365194.9Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse CVE-2020-36529.1Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length CVE-2020-365217.1An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows 11.4, iOS 14.0 and iPadOS 14.0