CVE-2020-36728

Published Jun 7, 2023

Last updated a year ago

CVSS critical 9.8

Overview

Description: The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full control of a site.
Source: security@wordfence.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:tunasite:adning_advertising:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C722C1E8-9862-45EF-B5A4-7716E9D2B168",
            "versionEndExcluding": "1.5.6"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References