CVE-2020-36742 Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass

What is CVE-2020-36742?

CVE-2020-36742 is a medium-severity vulnerability in hiroaki-miyashita Custom Field Template, published on 1 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the edit_meta_value() function. This makes it possible for unauthenticated attackers to edit meta field values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2020-36742?

It affects 1 product.

Products include Wpgogo Custom Field Template.

How do I fix CVE-2020-36742?

No fix has been published for CVE-2020-36742 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36742 being exploited?

There is no known exploitation of CVE-2020-36742 in the wild and no public exploit code.

Other vulnerabilities in hiroaki-miyashita Custom Field Template

• CVE-2022-4324 Custom Field Template < 2.5.8 - Admin+ PHP Object Injection High 7.2
• CVE-2023-38392 WordPress Custom Field Template Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS) High 7.1
• CVE-2024-44062 WordPress Custom Field Template plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2023-6745 Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode Medium 6.4
• CVE-2024-0627 Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j256-v92m-fqff.