CVE-2020-36831

MEDIUM

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in ve...

Affects 1 product across 1 vendor.

CVSS 3.16.5
EPSS0.5%
Percentile41th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-284: Improper Access Control

Software does not restrict or incorrectly restricts access to a resource.

CWE-862: Missing Authorization

Software does not check whether an authenticated actor has permission for the requested operation.

Related Attack Patterns (CAPEC)
CAPEC-478 Modification of Windows Service Configuration
via CWE-284
CAPEC-479 Malicious Root Certificate
via CWE-284
CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment
via CWE-284
CAPEC-550 Install New Service
via CWE-284
CAPEC-551 Modify Existing Service
via CWE-284
Show all 18

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, allowing low-privileged users to perform administrative actions.

BSID: BS-2024-GLOBAL-046425-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-36831?
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, allowing low-privileged users to perform administrative actions.
What is the CVSS score for CVE-2020-36831?
CVE-2020-36831 has CVSS 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS: 0.5%.
Is CVE-2020-36831 actively exploited?
No confirmed active exploitation of CVE-2020-36831 as of 2026-09-25.
How do I remediate CVE-2020-36831?
Priority: HIGH.
What systems are affected by CVE-2020-36831?
CVE-2020-36831 affects Nextscripts Social Networks Auto Poster.
Vulnerability Details
CVE IDCVE-2020-36831
BSIDBS-2024-GLOBAL-046425-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Published2024-10-16
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Improper Access ControlMissing Authorization
SourceNVD
Official Description

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged attackers, like subscribers, to perform restricted actions that would be otherwise locked to a administrative-level user.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers can exploit this vulnerability by accessing specific URLs or endpoints that are supposed to be restricted to administrative users. The lack of proper authorization checks means that even low-privileged users, such as subscribers, can perform actions that should be limited to administrators.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Nextscripts Social Networks Auto Poster < 4.3.18
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 730 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashcdeca6521cd3ae0cd8d822883b5ae4eff65510f26de6ed273a6f06ad18a61e12dbbd7c7369d08c9184725fd27c2a0cc235b481f2617c1dcb8eca772b194b1c8d
Related CVEs affecting Nextscripts
CVE-2026-27379 8.8 Deserialization of Untrusted Data vulnerability in NextScripts NextScripts so... CVE-2024-2088 6.5 The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerab... CVE-2021-25072 6.5 The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 d... CVE-2026-3228 6.4 The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerab... CVE-2021-24975 6.1 The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 d...
View all Nextscripts CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →