CVE-2020-36702 : Vulnerability Insights and Analysis

The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change due to missing capability checks on several AJAX actions.

Understanding CVE-2020-36702

The vulnerability allows authenticated attackers with subscriber+ roles to update the plugin's settings.

What is CVE-2020-36702?

The Ultimate Addons for Gutenberg plugin for WordPress is susceptible to an Authenticated Settings Change vulnerability in versions up to and including 1.14.7.

The Impact of CVE-2020-36702

This vulnerability enables authenticated attackers with specific roles to modify the plugin's settings, potentially leading to unauthorized changes.

Technical Details of CVE-2020-36702

The following technical details provide insight into the vulnerability.

Vulnerability Description

The vulnerability arises from missing capability checks on various AJAX actions within the plugin.

Affected Systems and Versions

Vendor: brainstormforce
Product: Spectra – WordPress Gutenberg Blocks
Versions Affected: up to and including 1.14.7

Exploitation Mechanism

The vulnerability allows authenticated attackers with subscriber+ roles to exploit AJAX actions and alter the plugin's settings.

Mitigation and Prevention

Taking immediate steps and implementing long-term security practices are crucial to mitigate the risk posed by CVE-2020-36702.

Immediate Steps to Take

Update the Ultimate Addons for Gutenberg plugin to version 1.14.8 or later.
Monitor plugin settings for any unauthorized changes.

Long-Term Security Practices

Regularly review and update user roles and permissions.
Conduct security audits to identify and address vulnerabilities proactively.

Patching and Updates

Apply patches and updates promptly to ensure the plugin's security is up to date.