Security readout for executives and security teams
Plain-English summary
This WordPress plugin vulnerability lets an attacker trick a logged-in administrator into deleting all blog comments. It is a CSRF issue, so the attacker needs the admin to interact with attacker-controlled content while authenticated. The documented impact is comment data loss, not server takeover.
Executive priority
Treat this as a targeted data-integrity risk for affected WordPress sites. It is not documented as remote code execution, but it can erase community or customer comment history if an admin is successfully targeted.
Technical view
CVE-2020-36505 affects Delete All Comments Easily WordPress plugin through version 1.3. Missing CSRF checks around the comment deletion action can allow an unauthenticated attacker to cause a logged-in admin browser to submit a destructive request. The weakness is CWE-352. No CVSS score or fixed version is provided in the source bundle.
Likely exposure
Exposure is limited to WordPress sites with Delete All Comments Easily installed at version 1.3 or earlier, especially sites where administrators remain logged in and can be lured to attacker-controlled pages.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. A public write-up is referenced, but the provided evidence supports vulnerability existence, not current exploitation in the wild.
Researcher notes
Evidence identifies missing CSRF checks and destructive comment deletion through admin interaction. Sources do not provide CVSS, a fixed release, exploit-in-the-wild confirmation, or broader affected CPE data. Avoid assuming impact beyond comment deletion.
Mitigation direction
- Inventory WordPress sites for Delete All Comments Easily versions through 1.3.
- Check vendor or plugin guidance for a fixed version or official mitigation.
- Disable or remove the plugin if no safe vendor guidance is available.
- Back up comment data before making plugin or site changes.
- Limit WordPress admin sessions to trusted devices and routine workflows.
Validation and detection
- Confirm whether Delete All Comments Easily is installed on each WordPress site.
- Record installed plugin versions and compare against affected version 1.3 or earlier.
- Review whether comment deletion requires CSRF protection in the deployed plugin.
- Check recent admin activity for unexpected bulk comment deletion.
- Verify comment backups can restore deleted content if needed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36505 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/239f8efa-8fa4-4274-904f-708e65083821CVE reference · x_refsource_MISC
- https://medium.com/%40hoanhp/0-day-story-2-delete-all-comments-easily-a854e52a7d50CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.