blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2020-36875

CRITICAL 9.3 CVSS 4.0
Published
January 9, 2026
Last modified
June 17, 2026
NVD status
Deferred
Reported by
disclosure@vulncheck.com
Weakness
CWE-94
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.

Affected products and versions

  • ACCESSALLY, INC. AccessAlly — Before 3.3.2

References

  • accessally.com https://accessally.com/software-release/accessally-3-3-2/
  • wpscan.com https://wpscan.com/vulnerability/c644de6d-098d-4889-b75d-53fd2b89ff4d/
  • www.vulncheck.com https://www.vulncheck.com/advisories/accessally-unauthenticated-arbitrary-php-code-execution
  • nvd.nist.gov Official NVD record