Vulnerability · Published Oct 1, 2025 · Assigned by Wordfence

CVE-2020-36852Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Database Wiping

Critical 9.1

In plain English

A critical-severity missing authorization in Custom Searchable Data Entry System from ghazale. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.3%top 73.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazale_sds_delete_entries_table_row() function. This makes it possible for unauthenticated attackers to completely wipe database tables such as wp_users.

Affected products (as reported)

Vendor	Product	Versions
ghazale	Custom Searchable Data Entry System	0 – through 1.7.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

In plain English

Official description

Affected products (as reported)

References