CVE-2020-36720: kaliforms kali_forms Missing Authorization
Vulnerability summary
CVE-2020-36720 is a high (CVSS 7.1) Missing Authorization vulnerability in kaliforms kali_forms. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 07-06-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST7.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- wordfenceSource7.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.79% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.nintechnet.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
3 vendors · 3 products
References
4 links- www.wordfence.com/threat-intel/vulnerabilities/id/9ed8e24d-6bd0-4638-9031-997ce2228fad?source=cveBroken LinkThird Party Advisory