CVE-2020-36759

The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Exploit, Third Party Advisory
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2368332%40insert-php&new=2368332%40insert-php&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e573c0a4-d053-400b-828c-0d0eca880776?source=cveThird Party Advisory
• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Exploit, Third Party Advisory
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2368332%40insert-php&new=2368332%40insert-php&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e573c0a4-d053-400b-828c-0d0eca880776?source=cveThird Party Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36753The Hueman theme for WordPress is vulnerable to Cross-Site R…4.3
• CVE-2020-36754The Paid Memberships Pro plugin for WordPress is vulnerable…4.3
• CVE-2020-36755The Customizr theme for WordPress is vulnerable to Cross-Sit…4.3
• CVE-2020-36756The 10WebAnalytics plugin for WordPress is vulnerable to Cro…4.3
• CVE-2020-36757The WP Hotel Booking plugin for WordPress is vulnerable to C…4.3
• CVE-2020-36758The RSS Aggregator by Feedzy plugin for WordPress is vulnera…4.3
• CVE-2020-3676Possible memory corruption in perfservice due to improper va…7.8
• CVE-2020-36760The Ocean Extra plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2020-36761The Top 10 plugin for WordPress is vulnerable to Cross-Site …4.3
• CVE-2020-36762A vulnerability was found in ONS Digital RAS Collection Inst…9.8
• CVE-2020-36763Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allow…5.4
• CVE-2020-36765Insufficient policy enforcement in Navigation in Google Chro…6.5