CVE-2020-36720: 
WordPress vulnerability analysis and mitigation

The Kali Forms plugin for WordPress contains an Authenticated Options Change vulnerability (CVE-2020-36720) affecting versions up to and including 2.1.1. The vulnerability was discovered and reported by Jerome Bruandet from NinTechNet (NinTechNet Blog).

The vulnerability stems from the update_option function lacking proper authentication checks. This security flaw has been assigned a CVSS v3.1 base score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. The vulnerability is classified as CWE-862: Missing Authorization (NVD).

The vulnerability allows any authenticated attacker to change or delete the plugin's settings, potentially leading to unauthorized configuration modifications and disruption of form functionality (Wordfence).

The vulnerability requires an authenticated user account to exploit, making it accessible to any logged-in user regardless of their privilege level. The attack complexity is considered low, requiring no special conditions or user interaction to execute (NVD).

Users should update their Kali Forms plugin to a version newer than 2.1.1 to address this vulnerability. The issue has been fixed in subsequent releases (WordPress Plugin).