CVE-2020-36718

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP Object.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
ninjateamGDPR CCPA Compliance & Cookie Consent Banner<= 2.3

References

Timeline

Published
Jun 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-367199.8The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and DeactivatiCVE-2020-367207.1The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to thCVE-2020-367216.5The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation.CVE-2020-367224.8The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient inCVE-2020-367235.3The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via theCVE-2020-367249.8The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of CVE-2020-367258.1The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versiCVE-2020-367269.8The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserializationCVE-2020-367279.8The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due tCVE-2020-367289.8The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This CVE-2020-367294.3The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' CVE-2020-36739.8u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the ind
CVE-2020-36718: Critical severity, CVSS 9.8 | Vulnix