CVE-2020-36670

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber level permissions and above to invoke these functions which can be used to perform actions like modify form submission records, deleting files, sending test emails, modifying plugin settings, and more.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
webaways	NEX-Forms – Ultimate Forms Plugin for WordPress	<= 7.7.1

References

Timeline

Published: Mar 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-36689.8u'Buffer overflow while parsing PMF enabled MCBC frames due to frame length being lesser than what is expected while parsing' in Snapdragon CVE-2020-36699.8u'Buffer Overflow issue in WLAN tcp ip verification due to usage of out of range pointer offset' in Snapdragon Auto, Snapdragon Compute, Sna CVE-2020-366915.5An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via CVE-2020-366925.4A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScri CVE-2020-366946.7An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, becaus CVE-2020-366957.8Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Man CVE-2020-366967.5The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the CVE-2020-366976.5The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2 CVE-2020-366988.8The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and includin CVE-2020-366994.3The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_qu CVE-2020-36709.1u'Potential out of bounds read while processing downlink NAS transport message due to improper length check of Information Element(IEI) NAS CVE-2020-367008.8The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is d