CVE-2020-36745 WP Project Manager <= 2.4.0 - Cross-Site Request Forgery Bypass
Unauthenticated attackers can trick administrators into triggering updates via forged requests, allowing unauthorized data modification in WP Project Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-36745?
CVE-2020-36745 is a medium-severity vulnerability in wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker, published on 1 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due to missing or incorrect nonce validation on the do_updates() function. This makes it possible for unauthenticated attackers to trigger updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Weakness: CWE-352
Which versions are affected by CVE-2020-36745?
It affects 1 product.
Products include Wedevs Wp Project Manager.
How do I fix CVE-2020-36745?
No fix has been published for CVE-2020-36745 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36745 being exploited?
There is no known exploitation of CVE-2020-36745 in the wild and no public exploit code.
Other vulnerabilities in wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- CVE-2023-3636 WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
- CVE-2023-34383 WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection
- CVE-2024-10174 Auth bypass in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- CVE-2024-13500 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
- CVE-2024-13752 WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
Sources
Also known as GHSA-c5fr-fxx7-gcp7.