RCE in Accessally, Inc. Accessally
CVE-2020-36875
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.007 (51.1th percentile) — read the EPSS interpretation.
Affected products
- Accessally, Inc. Accessally — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory, patch)
- disclosure@vulncheck.com (exploit, third-party-advisory)
- disclosure@vulncheck.com (third-party-advisory)