CVE-2020-36749

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-36759.8u'Potential integer underflow while parsing Service Info and IPv6 link-local TLVs that comes as part of NDPE attribute' in Snapdragon Auto, CVE-2020-367504.3The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is dCVE-2020-367514.3The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to miCVE-2020-367524.3The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1CVE-2020-367534.3The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing oCVE-2020-367544.3The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is CVE-2020-367554.3The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missinCVE-2020-367564.3The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to CVE-2020-367574.3The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due CVE-2020-367584.3The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This CVE-2020-367594.3The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is duCVE-2020-36767.8Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, Snapdrago
CVE-2020-36749: Medium severity, CVSS 4.3 | Vulnix