CVE-2020-36758

MITTEL 4.3CVE-2020-36758 · Published 20/10/2023 · updated 17/06/2026

Kurz gesagt

CVE-2020-36758 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in rss aggregator by feedzy (themeisle).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.48%, höher als bei 41.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
rss aggregator by feedzy themeisle	`≤ 3.4.2`	No fix yet

Description

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated attackers to update post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks · Exploit
blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1 · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2 · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3 · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4 · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5 · Not Applicable
plugins.trac.wordpress.org/changeset/2369394/feedzy-rss-feeds/trunk/includes/admin/feedzy-rss-feeds-admin.php · Patch

Weitere Schwachstellen in rss aggregator by feedzy

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free