CVE-2020-36875
CriticalSummary
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The login_error parameter is processed as PHP code, allowing an attacker to execute arbitrary PHP in the context of the WordPress web server.
Risk Assessment
A remote attacker can execute arbitrary PHP code on the server, potentially leading to full WordPress site compromise, data theft, or malware distribution.
Recommendation
Upgrade the AccessAlly plugin to version 3.3.2 or later immediately. Also scan the site for signs of compromise.
Original NVD description (English source)
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.