CVE-2020-36717 Kali Forms <= 2.1.1 - Cross-Site Request Forgery
Unauthenticated attackers can trick administrators into performing actions, leading to unauthorized access to administrative functions and potential data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-36717?
CVE-2020-36717 is a high-severity vulnerability in wpchill Kali Forms — Contact Form & Drag-and-Drop Builder, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handling throughout the plugin's function. This makes it possible for unauthenticated attackers to access the plugin's administrative functions via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Weakness: CWE-352
Which versions are affected by CVE-2020-36717?
It affects 1 product.
Products include Kaliforms Kali Forms.
How do I fix CVE-2020-36717?
No fix has been published for CVE-2020-36717 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36717 being exploited?
There is no known exploitation of CVE-2020-36717 in the wild and no public exploit code.
Other vulnerabilities in wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2020-36712 Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion
- CVE-2024-22305 Missing authorization in Contact Form builder with drag & drop for WordPress – Kali Forms
- CVE-2020-36720 Kali Forms <= 2.1.1 - Missing Authorization to Settings Update
- CVE-2025-3201 Kali Forms < 2.4.3 - Contributor+ Stored XSS
Sources
Also known as GHSA-v6g2-29p9-2r85.