CVE-2020-36698: cleantalk login security, firewall, malware removal by cleantalk Missing Authorization
Vulnerability summary
CVE-2020-36698 is a high (CVSS 8.8) Missing Authorization vulnerability in cleantalk login security, firewall, malware removal by cleantalk. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 20-10-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.18%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
+0.22 pp
From 0.96% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.nintechnet.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Cleantalk2 products
Wordpress1 product
- security-malware-firewall≤ 2.50 (fixed in 2.51)
2 vendors · 3 products
References
4 links- blog.nintechnet.com/multiple-vulnerabilities-fixed-in-security-malware-scan-by-cleantalk-plugin/ExploitThird Party Advisory
- wpscan.com/vulnerability/23960f42-dfc1-4951-9169-02d889283f01Third Party Advisory