CVE-2020-36749

The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Exploit, Technical Description, Third Party Advisory
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2370405%40easy-testimonials&new=2370405%40easy-testimonials&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8da49c2e-576c-490b-b812-96d15b6d2b1b?source=cveThird Party Advisory
• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Exploit, Technical Description, Third Party Advisory
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2370405%40easy-testimonials&new=2370405%40easy-testimonials&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8da49c2e-576c-490b-b812-96d15b6d2b1b?source=cveThird Party Advisory

Published

Jul 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36743The Product Catalog Simple plugin for WordPress is vulnerabl…4.3
• CVE-2020-36744The NotificationX plugin for WordPress is vulnerable to Cros…4.3
• CVE-2020-36745The WP Project Manager plugin for WordPress is vulnerable to…8.8
• CVE-2020-36746The Menu Swapper plugin for WordPress is vulnerable to Cross…4.3
• CVE-2020-36747The Lightweight Sidebar Manager plugin for WordPress is vuln…4.3
• CVE-2020-36748The Dokan plugin for WordPress is vulnerable to Cross-Site R…4.3
• CVE-2020-3675u'Potential integer underflow while parsing Service Info and…9.8
• CVE-2020-36750The EWWW Image Optimizer plugin for WordPress is vulnerable …4.3
• CVE-2020-36751The Coupon Creator plugin for WordPress is vulnerable to Cro…4.3
• CVE-2020-36752The Coming Soon & Maintenance Mode Page plugin for WordPress…4.3
• CVE-2020-36753The Hueman theme for WordPress is vulnerable to Cross-Site R…4.3
• CVE-2020-36754The Paid Memberships Pro plugin for WordPress is vulnerable…4.3