Medium severity6.5NVD Advisory· Published Nov 1, 2021· Updated Jun 17, 2026

CVE-2020-36505

Description

The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Delete All Comments Easily Project/Delete All Comments Easily
cpe:2.3:a:delete_all_comments_easily_project:delete_all_comments_easily:*:*:*:*:*:wordpress:*:*
Range: <=1.3
WordPress/Delete All Comments Easilycpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.3

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/239f8efa-8fa4-4274-904f-708e65083821nvdExploitThird Party Advisory
medium.com/%40hoanhp/0-day-story-2-delete-all-comments-easily-a854e52a7d50nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000