VulnerabilityModified

CVE-2020-36725

HIGH 8.1EPSS 1.14%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: 1.14% probability · 65th percentile
CISA KEV: Not listed
Weakness: CWE-862
Affected: templateinvaders/ti woocommerce wishlist
Source: security@wordfence.com

References

https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-ti-woocommerce-wishlist-plugin/Exploit, Third Party Advisory
https://templateinvaders.com/changelogs/ti-woocommerce-wishlist-plugin-changelog/Release Notes
https://wpscan.com/vulnerability/2e2fb815-7cca-4e6c-b466-179337fe99eeThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90?source=cveThird Party Advisory
https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-ti-woocommerce-wishlist-plugin/Exploit, Third Party Advisory
https://templateinvaders.com/changelogs/ti-woocommerce-wishlist-plugin-changelog/Release Notes
https://wpscan.com/vulnerability/2e2fb815-7cca-4e6c-b466-179337fe99eeThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90?source=cveThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.