CVE-2020-36720 : What You Need to Know

The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change, allowing attackers to modify plugin settings.

Understanding CVE-2020-36720

The vulnerability in the Kali Forms plugin for WordPress allows authenticated attackers to change or delete plugin settings due to missing authentication checks.

What is CVE-2020-36720?

The Kali Forms plugin for WordPress is susceptible to an Authenticated Options Change vulnerability in versions up to and including 2.1.1.

The Impact of CVE-2020-36720

This vulnerability enables any authenticated attacker to manipulate the plugin's settings, potentially leading to unauthorized changes or deletions.

Technical Details of CVE-2020-36720

The following technical details outline the specifics of CVE-2020-36720:

Vulnerability Description

The vulnerability arises from the update_option function lacking proper authentication checks, allowing authenticated attackers to modify plugin settings.

Affected Systems and Versions

Vendor: kaliforms
Product: Contact Form builder with drag & drop for WordPress – Kali Forms
Versions Affected: Up to and including 2.1.1

Exploitation Mechanism

Attackers with authenticated access can exploit the vulnerability by leveraging the missing authentication checks in the update_option function to alter or delete the plugin's settings.

Mitigation and Prevention

To address CVE-2020-36720, consider the following mitigation strategies:

Immediate Steps to Take

Update the Kali Forms plugin to version 2.1.2 or higher to mitigate the vulnerability.
Monitor plugin settings for any unauthorized changes.

Long-Term Security Practices

Regularly review and update plugins to the latest versions to address security vulnerabilities.
Implement strong authentication mechanisms to prevent unauthorized access to plugin settings.

Patching and Updates

Apply patches and updates provided by the plugin vendor to ensure ongoing security.