CVE-2020-36749 : Exploit Details and Defense Strategies

CVE-2020-36749, assigned by Wordfence, pertains to a Cross-Site Request Forgery vulnerability in the Easy Testimonials plugin for WordPress.

Understanding CVE-2020-36749

This CVE identifies a security issue in the Easy Testimonials plugin for WordPress that could allow unauthenticated attackers to manipulate custom fields.

What is CVE-2020-36749?

The vulnerability in the Easy Testimonials plugin for WordPress allows attackers to perform unauthorized actions by tricking site administrators into clicking on malicious links.

The Impact of CVE-2020-36749

The vulnerability could lead to unauthorized modification of custom fields by attackers, potentially compromising the integrity of the affected WordPress sites.

Technical Details of CVE-2020-36749

This section provides more technical insights into the CVE.

Vulnerability Description

The vulnerability arises from missing or incorrect nonce validation in the saveCustomFields() function of the Easy Testimonials plugin, enabling attackers to save custom fields via forged requests.

Affected Systems and Versions

Vendor: ghuger
Product: Easy Testimonials
Versions Affected: Up to and including 3.6.1

Exploitation Mechanism

Attackers can exploit this vulnerability by manipulating custom fields through forged requests, leveraging the absence of proper nonce validation.

Mitigation and Prevention

Protecting systems from CVE-2020-36749 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update the Easy Testimonials plugin to version 3.7 or higher to mitigate the vulnerability.
Educate site administrators about the risks of clicking on unverified links to prevent CSRF attacks.

Long-Term Security Practices

Regularly monitor and update plugins and themes to address security vulnerabilities promptly.
Implement strict access controls and authentication mechanisms to prevent unauthorized actions.

Patching and Updates

Ensure timely installation of security patches and updates for all WordPress plugins and themes to address known vulnerabilities.