ThemeGrill Demo Importer < 1.6.2 - Database Reset

ThemeGrill Demo Importer before 1.6.2 does not require authentication for wiping the database due to a resetwizardactions hook. In versions 1.3.4 and above and versions 1.6.1 and below, there is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state...

CVE-2020-36333

creationtimestamp| type| source ---|---|--- 2025-06-21 05:08:44+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-36333.yaml 2025-06-24 21:02:25+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lseymlaka722...

CVE-2020-36333

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...

CVE-2020-36333

The themegrill-demo-importer WordPress plugin versions prior to 1.6.2 (specifically versions 1.3.4 and above and versions 1.6.1 and below) contain an access control vulnerability. Due to a reset_wizard_actions hook that lacks authentication requirements, unauthenticated attackers can wipe the ent...