CVE-2020-36725highexploração observadaCWE-862

CVE-2020-36725: falha de alta gravidade em templateinvaders TI WooCommerce Wishlist

TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar TI WooCommerce Wishlist+ Monitorar TI WooCommerce Wishlist Pro

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

43Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 8.8epss 1.1%
da publicação à arma
Publicada no NVD7 de jun.
VulnCheck16 de out.
The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
templateinvaders · TI WooCommerce WishlistTemplateInvaders · TI WooCommerce Wishlist Pro
CVEs relacionadas — templateinvaders TI WooCommerce Wishlist

No mesmo produto, das mais perigosas para as menos.

CVE-2022-0412—TI WooCommerce Wishlist < 1.40.1 - Unauthenticated Blind SQL InjectionEPSS 74.0%CVE-2025-47577CRITICALWordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload VulnerabilityEPSS 4.6%CVE-2025-9207MEDIUMTI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML InjectionEPSS 0.4%CVE-2024-10567HIGHTI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard AccessEPSS 0.4%CVE-2025-58247MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-67929MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.3%