CVE-2020-36875CWE-94

AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution

Critical · published January 9, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00758 · 54.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-01-09T16:41Z
EPSS history
Timeline
  • 09 JAN 16:41Z
    AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution
    cvelistv5