CVE-2020-36837
Published: April 11, 2026
Official Description
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there is a user named 'admin', the attacker will become automatically logged in as an administrator.
Risk Analysis
The ThemeGrill Demo Importer plugin for WordPress has an authentication bypass vulnerability, allowing authenticated attackers to reset the database and gain administrator access. This critical flaw is actively exploited, as confirmed by its presence in the CISA KEV catalog, posing a severe risk of site compromise.
This vulnerability is actively exploited in the wild. Attackers require authenticated access to exploit this flaw, which can lead to full administrative control.
Update the ThemeGrill Demo Importer plugin to a version outside the vulnerable range of 1.3.4 through 1.6.1. Implement strong authentication practices and regularly audit user accounts for suspicious activity.
Technical Analysis
CVE-2020-36837 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2020-36837 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2020-36837 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1