« Volver al listado

CVE-2020-36504

Estado: ModificadaMedia (6.5)—

The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wp-pro-quiz Project — Wp-pro-quiz

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-36504",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Wp-Pro-Quiz",
          "versions": [
            {
              "status": "affected",
              "version": "0.37",
              "versionType": "custom",
              "lessThanOrEqual": "0.37"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-01T09:15:08.317",
  "references": [
    {
      "url": "https://medium.com/%40hoanhp/0-days-story-1-wp-pro-quiz-2115dd77a6d4",
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/83679b90-faa5-454e-924c-89f388eccbd1",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://medium.com/%40hoanhp/0-days-story-1-wp-pro-quiz-2115dd77a6d4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpscan.com/vulnerability/83679b90-faa5-454e-924c-89f388eccbd1",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog"
    },
    {
      "lang": "es",
      "value": "El plugin WP-Pro-Quiz de WordPress versiones hasta 0.37, no presenta una comprobación de CSRF cuando se elimina un cuestionario, lo que podría permitir a un atacante hacer que un administrador conectado elimine un cuestionario arbitrario en el blog"
    }
  ],
  "lastModified": "2026-06-17T03:15:37.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wp-pro-quiz_project:wp-pro-quiz:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F9FF5BE-AB55-49B2-AE38-2D959DCF1464",
              "versionEndIncluding": "0.37"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}