CVE-2020-36698: 
WordPress vulnerability analysis and mitigation

The Security & Malware scan by CleanTalk WordPress plugin (versions up to and including 2.50) was identified with a security vulnerability tracked as CVE-2020-36698. The vulnerability was publicly disclosed on July 6, 2020, and involves missing capability checks on several AJAX actions and nonce disclosure in the administrative dashboard source page (WPScan, NVD).

The vulnerability stems from missing authorization checks and security nonce leaks in the plugin's AJAX functionality. The issue is classified as CWE-862 (Missing Authorization) and has received a CVSS v3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The WPScan team noted that the remediation relies on CSRF checks for authorization instead of proper authorization verification using the currentusercan() function (WPScan).

The vulnerability allows authenticated attackers with subscriber-level permissions or higher to make unauthorized AJAX calls, potentially leading to arbitrary file deletion, file downloads, and unauthorized function calls (NVD).

The vulnerability has been fixed in version 2.51 of the Security & Malware scan by CleanTalk plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).