CVE-2020-36725highexplotación observadaCWE-862

CVE-2020-36725: fallo de gravedad alta en templateinvaders TI WooCommerce Wishlist

TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear TI WooCommerce Wishlist+ Monitorear TI WooCommerce Wishlist Pro

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 8.8epss 1.1%
de la publicación al arma
Publicada en NVD7 jun
VulnCheck16 oct
The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
templateinvaders · TI WooCommerce WishlistTemplateInvaders · TI WooCommerce Wishlist Pro
CVEs relacionadas — templateinvaders TI WooCommerce Wishlist

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-0412—TI WooCommerce Wishlist < 1.40.1 - Unauthenticated Blind SQL InjectionEPSS 74.0%CVE-2025-47577CRITICALWordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload VulnerabilityEPSS 4.6%CVE-2025-9207MEDIUMTI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML InjectionEPSS 0.4%CVE-2024-10567HIGHTI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard AccessEPSS 0.4%CVE-2025-58247MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-67929MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.3%