VulnSocial

CVE-2020-24186Disclosure(gvectors / wpdiscuz)

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

gvectors CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • wpdiscuz

Threat summary

  • Public PoC is present in monitored signal
  • 8 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-09-27); latest day: 3
  • 8 total mentions across 4 days

Affected systems

Vendors
gvectors
Products
wpdiscuz

Deep dive

Activity timeline8 mentions / 4d
01223Mentions · 2026-07-04: 1Mentions · 2026-09-11: 1Mentions · 2026-09-27: 3Mentions · 2026-10-02: 3PoC Mentioned / Linked · 2026-09-11: 1Technical Details · 2026-07-04: 1Technical Details · 2026-09-11: 107-0409-1109-2710-02
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-07-041
Disclosure1
2026-09-111
PoC1
Full discourse8 posts
  • M. Thibaut@banzance
    Disclosure

    #JaideÀMaFaçon : Alerte vulnérabilité. Plusieurs plateformes publiques et sensibles des entreprises et administrations au Cameroun sont affectées par des vulnérabilités critiques, notamment les CVE-2020-24186 (CVSS 10.0), CVE-2019-16124 (CVSS 9.8) et CVE-2020-35949 (CVSS 10.0).

    Post summary

    The post alerts that several public and sensitive platforms in Cameroon are affected by three high‑severity CVEs (CVE-2020-24186, CVE-2019-16124, CVE-2020-35949), providing CVSS scores but no exploit or patch information.

    15141978
    5.4K followersView on X
  • ExploitGrid@exploitgrid

    🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2026-21858 CVE-2026-53576 CVE-2026-61732 CVE-2020-24186 CVE-2025-24813 ..🧵👇

    11071513
    349 followersView on X
  • ExploitGrid@exploitgrid

    #ExploitGrid Daily #Digest 🚨 Top Exploits: CVE-2025-59528 (CVSS: 10) flowiseai CVE-2026-102427 (CVSS: 10) https://ordasoft.com CVE-2026-76570 (CVSS: 10) https://joomcode.com CVE-2026-85706 (CVSS: 10) gitlab CVE-2020-24186 (CVSS: 10) ..🧵👇

    11041210
    341 followersView on X
  • ExploitGrid@exploitgrid

    💀 CRITICAL Exploits Trending ├ CVE-2026-21858 · CVE-2026-53576 (Kestra) · PoC live ├ CVE-2026-61732 · PoC live └ CVE-2020-24186 · CVE-2025-24813 (Apache GOExploiter) · PoC live

    1003067
    349 followersView on X
  • ExploitGrid@exploitgrid

    💀 CRITICAL Exploits Trending ├ CVE-2025-59528 — FlowiseAI · PoC live ├ CVE-2026-102427 — Joomla (OrdaSoft) · PoC live ├ CVE-2026-76570 — Joomla (JoomCode) · PoC live ├ CVE-2026-85706 — GitLab · PoC live └ CVE-2020-24186 · PoC live

    1000046
    341 followersView on X
  • ExploitGrid@exploitgrid

    [EXPLOIT] CVE-2020-24186 [CRITICAL/PoC] CVSS: 10 CVE-2020-24186 🔗 https://exploitgrid.net/exploits/f1d3c7c4-6187-4d69-8dc5-7d9b79ce4527

    1000056
    341 followersView on X
  • ExploitGrid@exploitgrid

    [EXPLOIT] CVE-2020-24186 [CRITICAL/PoC] CVE-2020-24186 🔗 https://exploitgrid.net/exploits/087e4afd-5231-411f-a836-cfcba50db063

    1000050
    349 followersView on X
  • elc0ket@whoami_elc0ket
    PoC

    Writeup Aceituno de @thehackerslabs ¡Pwned! Vhost oculto (dns-prefetch) → RCE wpDiscuz 7.0.4 (CVE-2020-24186) → sudo NOPASSWD "most" filtra id_rsa root → John crackea passphrase → root Writeup completo aquí 👇 https://github.com/elc0ket/ctf-writeups/ #CTF #pentesting #WordPress https://t.co/WbXN0UP0M3

    Post summary

    A CTF writeup demonstrating exploitation of CVE‑2020‑24186 through a hidden vhost and RCE, leading to root via sudo privileges and password cracking, with a link to the full writeup.

    0000057
    22 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgvectorswpdiscuz-wordpress-

Explore more

Back to dashboardgvectors CVEswpdiscuz vulnerabilities