High severity · published Jun 7, 2023
CVE-2020-36701
Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'process_bulk_action' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level permissions and above to upload arbitrary files onto the server which can be used to execute code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme · kingthemes
through 2.9.3 · source: vendor
PB
Page Builder King Composer · King-theme
through 2.9.3 · source: NVD
Affected product
PB
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
kingthemes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36701
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36701
Exploit
https://blog.nintechnet.com/wordpress-kingcomposer-page-builder-fixed-multiple-critical-vulnerabilities/
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2320014%40kingcomposer&new=2320014%40kingcomposer&sfp_email=&sfph_mail=
Product
https://wordpress.org/plugins/kingcomposer/#developers
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/45a62dd0-386c-41b3-b8dd-ced443da9f92?source=cve
More from Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
8.8
CVE-2020-36700
Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control
4.8
CVE-2020-36709
Page Builder: KingComposer < 2.9.4 - Stored Cross-Site Scripting