CVE-2020-35938: pickplugins post_grid Deserialization of Untrusted Data
Vulnerability summary
CVE-2020-35938 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in pickplugins post_grid. EPSS estimates a 2.11% chance of exploitation in the next 30 days, higher than 81.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 01-01-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA7.5HighCVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:NDiffers
- wordfenceSource7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
2.11%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 2.08% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Pickplugins2 products
- post_grid< 2.0.73
- team_showcase< 1.22.16
Wordpress1 product
- team< 1.22.16
2 vendors · 3 products
References
2 links- www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins/X Refsource MISCExploitThird Party Advisory