CVE-2020-36743: Product Catalog Simple <= 1.5.13 - Cross-Site Request Forgery Bypass
The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This is due to missing or incorrect nonce validation on the implecodesaveproductsmeta() function. This makes it possible for unauthenticated attackers to update product meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-36743?
CVE-2020-36743 is a vulnerability in the Product Catalog Simple plugin for WordPress that allows for Cross-Site Request Forgery attacks.
What is the severity of CVE-2020-36743?
The severity of CVE-2020-36743 is medium with a CVSS score of 4.3.
How does CVE-2020-36743 affect the Product Catalog Simple plugin for WordPress?
CVE-2020-36743 affects versions up to, and including, 1.5.13 of the Product Catalog Simple plugin for WordPress.
How can unauthenticated attackers exploit CVE-2020-36743?
Unauthenticated attackers can exploit CVE-2020-36743 to update product metadata without proper authentication.
Are there any fixes or patches available for CVE-2020-36743?
Currently, there are no specific fixes or patches available for CVE-2020-36743. It is recommended to update to the latest version of the Product Catalog Simple plugin for WordPress when available.