Critical severity9.9NVD Advisory· Published Oct 16, 2024· Updated Apr 15, 2026

CVE-2020-36837

Description

The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there is a user named 'admin', the attacker will become automatically logged in as an administrator.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Themegrill Demo Importerinferred2 versions
>=1.3.4,<=1.6.1+ 1 more
- (no CPE)range: >=1.3.4,<=1.6.1
- (no CPE)range: 1.3.4 - 1.6.1
Package: https://wordpress.org/plugins/themegrill-demo-importer

Patches

Vulnerability mechanics

References

raw.githubusercontent.com/themegrill/themegrill-demo-importer/master/CHANGELOG.txtnvd
www.openwall.com/lists/oss-security/2020/02/19/1nvd
www.webarxsecurity.com/critical-issue-in-themegrill-demo-importer/nvd
www.wordfence.com/threat-intel/vulnerabilities/id/8c0dc694-854e-4f96-8c2d-7251c41a3ee9nvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000