CVE-2020-36725

HIGH 8.1CVE-2020-36725 · Published 07/06/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
ti woocommerce wishlist templateinvaders	`< 1.21.12< 1.21.5`	`1.21.121.21.5`

Description

The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.

References

blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-ti-woocommerce-wishlist-plugin · Exploit
templateinvaders.com/changelogs/ti-woocommerce-wishlist-plugin-changelog · Release Notes
wpscan.com/vulnerability/2e2fb815-7cca-4e6c-b466-179337fe99ee · Third Party Advisory
wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free