CVE-2020-36755

Summary

CVE-2020-36755 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Customizr theme for WordPress. Versions up to 4.3.0 are impacted by this issue. The vulnerability stems from the lack of proper nonce validation on theczr_fn_post_fields_save() function. Consequently, unauthenticated attackers can manipulate administrators into performing actions, such as clicking on a malicious link, which enables the attacker to post fields on behalf of the administrator. This can lead to potential security risks, including the unintended modification of site settings.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.