CVE-2020-36715: Login/Signup Popup < 1.5 - Missing Authorization
The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts into the plugin settings that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36715?
CVE-2020-36715 has a medium severity rating due to the potential for authenticated attackers to exploit the vulnerability.
How do I fix CVE-2020-36715?
To fix CVE-2020-36715, update the Login/Signup Popup plugin to version 1.4.1 or later.
Who is affected by CVE-2020-36715?
Users of the Login/Signup Popup plugin for WordPress versions up to and including 1.4 are affected by CVE-2020-36715.
What type of attack is possible with CVE-2020-36715?
CVE-2020-36715 allows authenticated attackers to inject arbitrary web scripts into the plugin settings.
What are the implications of CVE-2020-36715?
The implications of CVE-2020-36715 include potential cross-site scripting (XSS) attacks that could compromise user accounts.