CVE-2020-36744 NotificationX <= 1.8.2 - Cross-Site Request Forgery Bypass
MediumCVSS 4.3
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to missing or incorrect nonce validation on the generate_conversions() function. This makes it possible for unauthenticated attackers to generate conversions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress notificationx(WordPress) | < 1.8.3 | 1.8.3 |
| WPDeveloper NotificationX | <= 1.8.2 | No fix listed |
| wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | < 1.8.3 | 1.8.3 |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- blog.nintechnet.com third-party-advisory
- blog.nintechnet.com third-party-advisory
- blog.nintechnet.com third-party-advisory
- blog.nintechnet.com third-party-advisory
- blog.nintechnet.com third-party-advisory
- blog.nintechnet.com third-party-advisory
- blog.nintechnet.com third-party-advisory
- plugins.trac.wordpress.org not-applicable
- www.wordfence.com third-party-advisory