Security readout for executives and security teams
Plain-English summary
CVE-2020-36749 affects the WordPress Easy Testimonials plugin up to version 3.6.1. An attacker could trick a logged-in site administrator into triggering an unwanted action that saves custom fields. Business impact is limited integrity risk, not data theft or outage in the provided scoring.
Executive priority
Treat as a routine but real web integrity issue. Prioritize remediation on public WordPress sites using this plugin, especially sites with frequent administrator activity. It should not displace critical vulnerabilities unless exploitation evidence emerges.
Technical view
The issue is CWE-352 CSRF caused by missing or incorrect nonce validation in Easy Testimonials' saveCustomFields() function. CVSS 3.1 is 4.3: network reachable, low complexity, no privileges, user interaction required, with low integrity impact only.
Likely exposure
Exposure is likely limited to WordPress sites running Easy Testimonials version 3.6.1 or earlier, where an administrator can be induced to perform an action while authenticated. The source bundle's affected-product metadata is sparse and partly inconsistent, so confirm plugin presence and version directly.
Exploitation context
The bundle does not indicate active exploitation, and KEV status is false. Practical abuse depends on social engineering a logged-in administrator into a forged request. The cited impact is saving custom fields, not full site takeover.
Researcher notes
The strongest evidence is the described missing nonce validation in saveCustomFields() and the WordPress Trac changeset. The source bundle does not provide proof of exploitation or detailed downstream impact. Affected-version metadata should be verified against plugin release history.
Mitigation direction
- Upgrade Easy Testimonials beyond version 3.6.1 or to the current vendor-supported release.
- Check vendor and WordPress plugin guidance for the confirmed fixed version.
- Review administrator workflows for suspicious links while logged into WordPress.
- Restrict administrator access to trusted users and enforce normal WordPress admin hygiene.
Validation and detection
- Inventory WordPress sites for the Easy Testimonials plugin and installed version.
- Confirm any installed version is newer than 3.6.1 or vendor-marked fixed.
- Review testimonial custom fields for unexpected or unauthorized changes.
- Check WordPress admin logs, if available, around suspicious custom field updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36749 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8da49c2e-576c-490b-b812-96d15b6d2b1b?source=cveCVE reference
- https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/CVE reference
- https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2370405%40easy-testimonials&new=2370405%40easy-testimonials&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.