CVE Intelligence
Analysis AI-assisted

CVE-2020-37071: CraftCMS vCard Plugin: untrusted data deserialization leading to remote code execution

CVE-2020-37071 affects the CraftCMS 3 vCard Plugin 1.0.0 and is classified as CWE-502 (deserialization of untrusted data). The record describes unauthenticated arbitrary PHP code execution through the plugin's vCard download functionality, and it carries a critical CVSS 3.1 score of 9.8. The record lists no affected or fixed version data and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes the CraftCMS 3 vCard Plugin 1.0.0 as containing a deserialization vulnerability (CWE-502). According to the record, unauthenticated attackers may execute arbitrary PHP code through a crafted payload tied to the plugin's vCard download functionality. The CNA is VulnCheck, the published date in the record is 2026-02-03, and the record's source status is Deferred.

Impact

  • The record gives a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates network reachability, no privileges or user interaction required, and high impact on confidentiality, integrity and availability.
  • The same provider also lists a CVSS 4.0 score of 9.3.
  • Arbitrary code execution would generally let an attacker control the web server process. This is an inference from the description, not a confirmed outcome in the sources.

Affected products and versions

  • The record names the CraftCMS 3 vCard Plugin, version 1.0.0.
  • The structured affected list in the record is empty, so the full range of affected versions is unknown.
  • Plugin page: CraftCMS vCard plugin.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog, so no active exploitation can be stated from KEV data.
  • The record references public third-party material, including an Exploit-DB entry and a GitLab repository. Their presence shows public exploit material is referenced, but it does not confirm how widely it is used.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The record contains no fixed version or vendor fix list, so the fix status is unknown. The absence of data does not mean no fix exists.
  • Check the plugin page and the VulnCheck advisory for updates, and confirm the installed plugin version.
  • If no fix can be confirmed, consider disabling or removing the plugin where it is not needed, restricting network exposure of the site, and limiting access to the affected functionality.
  • Treat the component as a potential remote code execution path until its version status is verified.

Detection guidance

  • Inventory all CraftCMS installations and record whether the vCard plugin is present and which version is installed.
  • Review web server and application logs for unusual activity around the vCard download functionality.
  • Watch for unexpected child processes of the PHP runtime, new or modified files in web-accessible directories, and outbound connections initiated by the web server.

Limitations of the available information

  • The record has no affected version range and no fixed version.
  • No EPSS or SSVC data is present in the record.
  • The record's source status is Deferred.
  • The flaw description comes from the record and was not independently verified against a vendor advisory.

Frequently asked questions

What is CVE-2020-37071?

It is a deserialization vulnerability (CWE-502) in the CraftCMS 3 vCard Plugin 1.0.0, which the record says can lead to unauthenticated arbitrary PHP code execution.

How severe is this CVE according to the record?

The record lists a CVSS 3.1 base score of 9.8 (critical) and a CVSS 4.0 score of 9.3, both from VulnCheck.

Is this vulnerability known to be exploited in the wild?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are fixed?

The record contains no fixed version data, so the fix status is unknown. Check the plugin page and the VulnCheck advisory for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.