Security readout for executives and security teams
Plain-English summary
This flaw lets a logged-in WordPress user change protected site settings through the TI WooCommerce Wishlist plugin. On a WooCommerce site, that can affect confidentiality, integrity, and availability because WordPress options often control access, behavior, and security-sensitive configuration.
Executive priority
Prioritize remediation on revenue-generating WooCommerce sites and sites allowing customer registration. The issue is high impact, remotely reachable, and low complexity once authenticated, but current active exploitation is not proven in the provided sources.
Technical view
CVE-2020-36725 is a missing authorization issue in TI WooCommerce Wishlist up to 1.21.11 and TI WooCommerce Wishlist Pro up to 1.21.4, involving includes/export.class.php. Authenticated network attackers can update arbitrary WordPress options without user interaction. CVSS 3.1 is 8.8 high.
Likely exposure
Exposure is limited to WordPress/WooCommerce sites running the named TemplateInvaders wishlist plugins at vulnerable versions. The attacker must already have authenticated access, but the required privilege is described only as low, so weak subscriber/customer account controls increase risk.
Exploitation context
The bundle does not show a CISA KEV listing. One referenced Nintechnet title characterizes the issue as a fixed zero-day, but the provided evidence does not establish current active exploitation or public exploit availability.
Researcher notes
The affected data names an arbitrary options update through export.class.php and maps to CWE-862. The source bundle is thin on root-cause details, exact fixed release, and exploit observations, so validation should stay version- and configuration-focused.
Mitigation direction
- Upgrade the affected plugin to a current vendor-supported release.
- Verify the fixed version against TemplateInvaders changelog, Wordfence, or WPScan.
- Remove or disable the plugin if an update cannot be applied promptly.
- Limit and review low-privilege WordPress accounts on affected sites.
- Review WordPress options and admin users for unexpected changes.
Validation and detection
- Inventory WordPress sites for TI WooCommerce Wishlist and Pro installations.
- Confirm installed versions are above 1.21.11 or 1.21.4 respectively.
- Check whether untrusted users can authenticate to the affected WordPress site.
- Review logs for suspicious authenticated requests around the plugin export component.
- Compare key WordPress options against known-good configuration baselines.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36725 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90?source=cveCVE reference
- https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-ti-woocommerce-wishlist-plugin/CVE reference
- https://templateinvaders.com/changelogs/ti-woocommerce-wishlist-plugin-changelog/CVE reference
- https://wpscan.com/vulnerability/2e2fb815-7cca-4e6c-b466-179337fe99eeCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.