CVE-2020-36715 : What You Need to Know

The Login/Signup Popup plugin for WordPress is vulnerable to an authorization bypass, allowing authenticated attackers to inject arbitrary web scripts into the plugin settings.

Understanding CVE-2020-36715

The vulnerability in the Login/Signup Popup plugin for WordPress allows attackers to execute arbitrary web scripts by bypassing authorization checks.

What is CVE-2020-36715?

The Login/Signup Popup plugin for WordPress is susceptible to an authorization bypass due to missing capability checks on specific functions in versions up to and including 1.4. This flaw enables authenticated attackers to inject malicious web scripts into the plugin settings, potentially leading to script execution upon user interaction.

The Impact of CVE-2020-36715

The vulnerability poses a high severity risk, with a CVSS base score of 7.4, allowing attackers to execute arbitrary scripts within the plugin settings.

Technical Details of CVE-2020-36715

The technical details of the CVE-2020-36715 vulnerability are as follows:

Vulnerability Description

The vulnerability arises from missing capability checks in the Login/Signup Popup plugin for WordPress, enabling authenticated attackers to inject arbitrary web scripts into the plugin settings.

Affected Systems and Versions

Vendor: xootix
Product: Login/Signup Popup (Inline Form + Woocommerce)
Versions Affected: Up to and including 1.4

Exploitation Mechanism

Attackers can exploit this vulnerability by tricking users into performing actions such as clicking on a link, allowing them to inject and execute arbitrary web scripts.

Mitigation and Prevention

To mitigate the risks associated with CVE-2020-36715, consider the following steps:

Immediate Steps to Take

Update the Login/Signup Popup plugin to version 1.5 or higher.
Monitor plugin settings for any unauthorized changes.
Educate users about the risks of clicking on suspicious links.

Long-Term Security Practices

Regularly update plugins and themes to the latest versions.
Implement strong authentication mechanisms to prevent unauthorized access.

Patching and Updates

Ensure timely installation of security patches and updates provided by the plugin vendor to address the vulnerability.