Critical severity · published Jun 7, 2023
CVE-2020-36718
GDPR CCPA Compliance Support <= 2.3 - PHP Object Injection
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP Object.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
GDPR CCPA Compliance & Cookie Consent Banner · ninjateam
through 2.3 · source: vendor
GC
Gpdr Ccpa Compliance Support · Ninjateam
through 2.3 · source: NVD
Affected product
GC
GDPR CCPA Compliance & Cookie Consent Banner
ninjateam
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36718
Exploit
https://blog.nintechnet.com/gdpr-ccpa-compliance-support-plugin-fixed-insecure-deserialization-vulnerability/
Patch
https://plugins.trac.wordpress.org/changeset/2408938
Patch
https://plugins.trac.wordpress.org/changeset/2411356/ninja-gdpr-compliance
Product
https://wordpress.org/plugins/ninja-gdpr-compliance/#developers
Third Party Advisory
https://wpscan.com/vulnerability/92f1d6fb-c665-419e-a13b-688b1df6c395
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/a2871261-3231-4a52-9a38-bb3caf461e7d?source=cve
More from GDPR CCPA Compliance & Cookie Consent Banner
8.8
CVE-2025-24591
WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerability
5.4
CVE-2024-5607
GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting