Vulnerabilities > CVE-2020-36725 - Missing Authorization vulnerability in Templateinvaders TI Woocommerce Wishlist
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
NONE Summary
The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-ti-woocommerce-wishlist-plugin/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90?source=cve
- https://wpscan.com/vulnerability/2e2fb815-7cca-4e6c-b466-179337fe99ee
- https://templateinvaders.com/changelogs/ti-woocommerce-wishlist-plugin-changelog/