CVE-2020-36831

MEDIUM EPSS 38.3%
Published Oct 16, 20241y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Oct 16, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged attackers, like subscribers, to perform restricted actions that would be otherwise locked to a administrative-level user.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
38.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-284
CWE-862 Missing Authorization Authorization

Affected Products 1

VendorProductVersionRange
nextscriptssocial_networks_auto_poster* <4.3.18

References 4

  • blog.sucuri.net https://blog.sucuri.net/2020/09/insufficient-privilege-validation-in-nextscripts-social-networks-auto-poster.html
    Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/0641578b-16b9-4d79-af69-b4886840da36
    Third Party Advisory
  • acunetix.com https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-nextscripts-social-networks-auto-poster-security-bypass-4-3-17/
    Third Party Advisory
  • wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/3709465d-6d67-45bd-abb9-4875065b8129?source=cve
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.