{"id":"CVE-2020-36725","state":"PUBLISHED","title":"TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update","description":"The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.","publishedAt":"2023-06-07T01:51:45.136Z","updatedAt":"2026-04-08T17:26:16.105Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Wordfence"},"assigner":"Wordfence","products":["TemplateInvaders TI WooCommerce Wishlist Pro","templateinvaders TI WooCommerce Wishlist"],"affected":[{"vendor":"TemplateInvaders","product":"TI WooCommerce Wishlist Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.21.4","versionType":"semver"}]},{"vendor":"templateinvaders","product":"TI WooCommerce Wishlist","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.21.11","versionType":"semver"}]}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90?source=cve","https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-ti-woocommerce-wishlist-plugin/","https://templateinvaders.com/changelogs/ti-woocommerce-wishlist-plugin-changelog/","https://wpscan.com/vulnerability/2e2fb815-7cca-4e6c-b466-179337fe99ee"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T19:47:24.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/36xxx/CVE-2020-36725.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-36725","state":"PUBLISHED","datePublished":"2023-06-07T01:51:45.136Z","dateUpdated":"2026-04-08T17:26:16.105Z","assignerShortName":"Wordfence","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateReserved":"2023-06-06T13:19:52.903Z"},"containers":{"cna":{"title":"TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update","descriptions":[{"lang":"en","value":"The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings."}],"affected":[{"vendor":"TemplateInvaders","product":"TI WooCommerce Wishlist Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.21.4","versionType":"semver"}]},{"vendor":"templateinvaders","product":"TI WooCommerce Wishlist","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.21.11","versionType":"semver"}]}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90?source=cve"},{"url":"https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-ti-woocommerce-wishlist-plugin/"},{"url":"https://templateinvaders.com/changelogs/ti-woocommerce-wishlist-plugin-changelog/"},{"url":"https://wpscan.com/vulnerability/2e2fb815-7cca-4e6c-b466-179337fe99ee"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862 Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"Wordfence","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateUpdated":"2026-04-08T17:26:16.105Z"},"credits":[{"lang":"en","type":"finder","value":"Jerome Bruandet"}],"timeline":[{"time":"2020-10-16T00:00:00.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90?source=cve","tags":["x_transferred"]},{"url":"https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-ti-woocommerce-wishlist-plugin/","tags":["x_transferred"]},{"url":"https://templateinvaders.com/changelogs/ti-woocommerce-wishlist-plugin-changelog/","tags":["x_transferred"]},{"url":"https://wpscan.com/vulnerability/2e2fb815-7cca-4e6c-b466-179337fe99ee","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T17:37:06.721Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-23T16:00:46.855169Z","id":"CVE-2020-36725","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-23T16:20:52.900Z"}}]}}}