AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution
Priority HIGH 81CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00758 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed AccessAlly (ACCESSALLY, INC.): 3.3.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AccessAlly | AccessAlly | before 3.3.2 | 3.3.2 | Patch available | CNA |
- AccessAlly VendorAccessAlly Affected before 3.3.2 Fixed in 3.3.2 Patch available CNA
Remediation
- Fix · CNA AccessAlly (ACCESSALLY, INC.) Fixed in 3.3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36875
- 2026-10-03 Alias added: GHSA-w273-q2jx-gwwp
References
More AccessAlly vulnerabilities
- TI-2024-15561 WordPress PopupAlly plugin <= 2.1.0 - Broken Access Control vulnerability CVSS 3.1MEDIUM 4.3
- TI-2021-06518 AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage CVSS 3.1HIGH 7.5
- TI-2024-23083 WordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9
- TI-2024-22223 WordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9
Sources
- CVE-2020-36875 · CVE Program
- CVE-2020-36875 · NVD
- FIRST EPSS
- GHSA-w273-q2jx-gwwp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences