CVE-2020-36759

MITTEL 4.3CVE-2020-36759 · Published 20/10/2023 · updated 17/06/2026

Kurz gesagt

CVE-2020-36759 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in woody code snippets (cm-wp).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.48%, höher als bei 41.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
woody code snippets cm-wp	`≤ 2.3.9`	No fix yet

Description

The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks · Exploit
blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1 · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2 · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3 · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4 · Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5 · Not Applicable
plugins.trac.wordpress.org/changeset · Patch

Weitere Schwachstellen in woody code snippets

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free