Now officially on WordPress.org

CVE Database / CVE-2020-36750

CVE · Medium

CVE-2020-36750 — EWWW Image Optimizer [ewww-image-optimizer] < 5.9

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2020-36750 EWWW Image Optimizer [ewww-image-optimizer] < 5.9 Cross-Site Request Forgery (CSRF) Medium 4.3 < 5.9 5.9 2020-09-06 —

CVE-2020-36750

The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to perform bulk image optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Source: CVE.org

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings