CVE-2020-36718 – The GDPR CCPA Compliance Support plugin for Wor... (How to Fix)

Q: What is the severity of CVE-2020-36718?

CVE-2020-36718 has a CVSS score of 9.8 (CRITICAL). The GDPR CCPA Compliance Support plugin for WordPress has a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by deserializing malicious input. This affects all WordPress sites using plugin versions up to 2.3. Attackers can potentially take full control of vulnerable websites.

📋 TL;DR

The GDPR CCPA Compliance Support plugin for WordPress has a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by deserializing malicious input. This affects all WordPress sites using plugin versions up to 2.3. Attackers can potentially take full control of vulnerable websites.

💻 Affected Systems

Products:

WordPress GDPR CCPA Compliance Support plugin (Ninja GDPR Compliance)

Versions: All versions up to and including 2.3

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Any WordPress site with the vulnerable plugin enabled is affected regardless of configuration.

📦 What is this software?

Gpdr Ccpa Compliance Support by Ninjateam

View all CVEs affecting Gpdr Ccpa Compliance Support →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise leading to website defacement, data theft, malware installation, or ransomware deployment.

🟠

Likely Case

Remote code execution leading to backdoor installation, credential theft, and lateral movement within the hosting environment.

🟢

If Mitigated

Limited impact with proper web application firewalls and intrusion detection systems blocking exploitation attempts.

🌐 Internet-Facing: HIGH - This affects WordPress plugins exposed to the internet, allowing direct exploitation without authentication.

🏢 Internal Only: LOW - WordPress sites are typically internet-facing, making internal-only exposure rare.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public exploit details available in security advisories. The vulnerability requires minimal technical skill to exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4 and later

Vendor Advisory: https://wordpress.org/plugins/ninja-gdpr-compliance/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'GDPR CCPA Compliance Support' plugin. 4. Click 'Update Now' if available. 5. If no update appears, manually download version 2.4+ from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable vulnerable plugin

linux

Temporarily disable the plugin until patched

wp plugin deactivate ninja-gdpr-compliance

Web Application Firewall rule

all

Block requests containing malicious deserialization patterns

Add WAF rule to block requests with 'njt_gdpr_allow_permissions' parameter containing serialized PHP objects

🧯 If You Can't Patch

Disable the GDPR CCPA Compliance Support plugin immediately
Implement strict input validation and sanitization for all plugin parameters

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins → GDPR CCPA Compliance Support → Version number. If version is 2.3 or lower, you are vulnerable.

Check Version:

wp plugin get ninja-gdpr-compliance --field=version

Verify Fix Applied:

Verify plugin version is 2.4 or higher in WordPress admin panel. Test that the 'njt_gdpr_allow_permissions' parameter no longer accepts serialized PHP objects.

📡 Detection & Monitoring

Log Indicators:

POST requests to WordPress containing 'njt_gdpr_allow_permissions' parameter with serialized data
Unusual PHP process execution from web server context
Web server error logs showing deserialization errors

Network Indicators:

HTTP POST requests with serialized PHP objects in parameters
Traffic patterns matching known exploit payloads

SIEM Query:

source="web_logs" AND (uri_path="*wp-admin*" OR uri_path="*wp-content/plugins/ninja-gdpr-compliance*") AND http_method="POST" AND (param_name="njt_gdpr_allow_permissions" OR param_value CONTAINS "O:")

📊 Metadata

CVE ID: CVE-2020-36718

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: June 7, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-36718, you might also want to check these: