CVE-2020-36724

The CVE-2020-36724 issue affects the Wordable plugin for WordPress (versions up to and including 3.1.1). The root cause is an authentication bypass caused by using a user-supplied hashing algorithm passed to hash_hmac() and a loose hash comparison, which can mislead the system into accepting a fo...

CVE-2020-36724 Wordable <= 3.1.1 - Authentication Bypass

The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hashhmac function and the use of a loose comparison on the hash which allows an attacker to trick the functio...