CVE-2020-36761: Top 10 <= 2.9.4 - Cross-Site Request Forgery Bypass
The Top 10 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing or incorrect nonce validation on the tptnexporttables() function. This makes it possible for unauthenticated attackers to generate an export of the top 10 table via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-36761?
CVE-2020-36761 is a vulnerability in the Top 10 plugin for WordPress that allows unauthenticated attackers to perform Cross-Site Request Forgery attacks.
What is the severity of CVE-2020-36761?
The severity of CVE-2020-36761 is medium, with a base score of 4.3.
How does CVE-2020-36761 affect WordPress?
CVE-2020-36761 affects WordPress through the Top 10 plugin versions up to and including 2.10.4.
How can an attacker exploit CVE-2020-36761?
An attacker can exploit CVE-2020-36761 by tricking a logged-in user into visiting a specially crafted website, which then performs unauthorized actions on the victim's behalf.
How can I protect my WordPress site from CVE-2020-36761?
To protect your WordPress site from CVE-2020-36761, update the Top 10 plugin to version 2.10.5 or higher.