What is the CVSS score of CVE-2020-36849?

CVE-2020-36849 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 72.2%.

Which versions of PHP are affected by CVE-2020-36849?

Organizations using the AIT CSV Import/Export WordPress plugin (versions up to 3.0.3) face critical risk of complete server compromise through arbitrary file uploads.

Is there a public PoC exploit available for CVE-2020-36849?

Yes, a public proof-of-concept exploit is available for CVE-2020-36849. Prioritise patching immediately. EPSS: 72.2%.

How to fix or mitigate CVE-2020-36849?

Within 24 hours: Identify all WordPress instances using the vulnerable plugin and disable the plugin immediately, or if functionality is required, restrict access to the upload feature via Web Application Firewall rules to trusted IPs only. Within 7 days: Either uninstall the plugin entirely and identify alternative solutions, or contact the vendor for a security update timeline and escalate for executive approval on risk acceptance if continued use is necessary. Within 30 days: Implement a WordPress plugin governance policy requiring security assessments before deployment and automated vulnerability scanning for all plugins.

PHP CVE-2020-36849

EUVD-2020-30798 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-07-12 security@wordfence.com

PHP WordPress RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2020-30798

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

PoC Detected

Mar 04, 2026 - 16:55 vuln.today

Public exploit code

CVE Published

Jul 12, 2025 - 12:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

AnalysisAI

The AIT CSV Import/Export WordPress plugin through version 3.0.3 allows unauthorized arbitrary file uploads without file type validation. The upload handler in upload-handler.php is accessible without authentication, enabling remote attackers to deploy PHP webshells and achieve code execution on the WordPress server.

Technical ContextAI

The upload-handler.php in the plugin's admin directory processes file uploads without requiring WordPress authentication or validating file types. The file is stored in a web-accessible location. An attacker can upload a PHP file and access it directly to execute arbitrary code.

RemediationAI

Remove the AIT CSV Import/Export plugin. If removal is not possible, block access to upload-handler.php at the web server level. Scan the uploads directory for PHP files and remove any found.

More from same product – last 7 days

CVE-2026-49952 CRITICAL Act Now POC

9.3 Jun 15

Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce

CVE-2026-49954 HIGH This Week POC

8.6 Jun 15

Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a

CVE-2026-49768 CRITICAL Act Now

9.8 Jun 15

Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to

CVE-2026-27053 CRITICAL Act Now

9.8 Jun 15

Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot

CVE-2026-49104 CRITICAL Act Now

9.8 Jun 15

Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo

CVE-2020-36849 vulnerability details – vuln.today

Back

PHP CVE-2020-36849

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More from same product – last 7 days

Share

External POC / Exploit Code