CVE-2020-36750

The EWWW Image Optimizer plugin through version 5.8.1 contains a Cross-Site Request Forgery vulnerability affecting the ewww_ngg_bulk_init() function due to inadequate nonce validation. An unauthenticated attacker can exploit this flaw by crafting a malicious request that, when clicked by a site administrator, triggers unauthorized bulk image optimization operations. The vulnerability requires social engineering to succeed but poses a risk to site administrators who may unknowingly initiate unintended actions.

Based on public CVE data (MITRE/NVD).