CVE-2020-36700: King-Theme Page Builder Kingcomposer

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress options, delete arbitrary files/folders, and inject arbitrary content.

Affected products

• King-Theme Page Builder Kingcomposer: up to and including 2.9.3

Published 2023-06-07. Last modified 2026-06-17.