CVE-2020-36725: TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update
The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36725?
CVE-2020-36725 has a high severity rating due to its Options Change vulnerability affecting certain versions of the TI WooCommerce Wishlist plugins.
How do I fix CVE-2020-36725?
To fix CVE-2020-36725, update the TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins to versions 1.21.12 or later for free and 1.21.5 or later for pro.
Who is affected by CVE-2020-36725?
Authenticated users of the TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for versions up to 1.21.11 and 1.21.4 are potentially affected by CVE-2020-36725.
What can an attacker do with CVE-2020-36725?
An authenticated attacker can exploit CVE-2020-36725 to change options in the TI WooCommerce Wishlist plugins.
Are there any known exploits for CVE-2020-36725?
Yes, CVE-2020-36725 has been identified as a critical vulnerability that may be actively exploited.