WordPress Plugin Vulnerabilities

EWWW Image Optimizer < 5.9 - Cross-Site Request Forgery

Description

The plugin does not correctly validate nonces in the ewww_ngg_bulk_init() function, resulting in a Cross-Site Request Forgery vulnerability. This may enable an unauthenticated user to perform bulk image optimization if they are able to deceive a site administrator into clicking on a manipulated link.

Affects Plugins

Plugin icon
ewww-image-optimizer
Fixed in 5.9

References

CVE
CVE-2020-36750
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef33e3c-187a-45d9-9dac-0895dce34216

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Jerome Bruandet
Verified
No
WPVDB ID
9fe6e899-17da-46fb-a0ff-cb6579b3dfa6

Timeline

Publicly Published
2020-09-06 (about 5 years ago)
Added
2023-07-12 (about 2 years ago)
Last Updated
2023-07-12 (about 2 years ago)

Other

Published
Title
Published
2025-12-11
Title
Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion
Published
2024-04-11
Title
Crony Cronjob Manager <= 0.5.0 - Cross-Site Request Forgery
Published
2025-01-31
Title
WordPress Signature <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-09-22
Title
CouponXxL <= 4.5.0 - Cross-Site Request Forgery
Published
2025-09-22
Title
WPMK PDF Generator <= 1.0.1 - Cross-Site Request Forgery