CVE-2020-36753
The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the save_meta_box() function. This makes it possible for unauthenticated attackers to save metabox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
We have discovered 3,753 live websites that are affected by CVE-2020-36753.
Affected Software
| Product |  Hueman |
| Category | Wordpress Themes |
| Vulnerable Versions |
|
| Total Vulnerable Versions | 196 |
| Vulnerable Domains | 3,753 live websites (22.66% of Hueman install base) |
Details
- Published - Oct 20, 2023
- Updated - Oct 20, 2023
Credits
- Jerome Bruandet (finder)
CVE References
CWE References
Countries
 United States | 723 websites |
 Germany | 378 websites |
 Russia | 315 websites |
 Japan | 300 websites |
 France | 270 websites |
 Poland | 225 websites |
 Italy | 205 websites |
 Sweden | 134 websites |
 Netherlands | 94 websites |
 GB | 86 websites |
TLDs
| .com | 1,223 websites |
| .ru | 252 websites |
| .de | 219 websites |
| .org | 217 websites |
| .pl | 179 websites |
| .net | 166 websites |
| .it | 146 websites |
| .fr | 127 websites |
| .se | 118 websites |
| .nl | 74 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redReferences
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d54b4dc9-8590-433c-873a-efb49e2e79cd?source=cve
- https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/
- https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/
- https://themes.trac.wordpress.org/browser/hueman/3.6.4/option-tree/includes/class-ot-meta-box.php#L207
Websites affected by CVE-2020-36753
Top websites that are affected by CVE-2020-36753. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ***.************************.**.uk | GB | **,*** | |
| ***.********.org | Germany | **,*** | |
| ************.com | United States | ***,*** | |
| ***.**************************.it | Italy | ***,*** | |
| ****************.com | United States | ***,*** | |
| ******.********.com |  Ukraine | ***,*** | |
| **********.com |  Hong Kong | ***,*** | |
| ***.**********.gr |  Greece | ***,*** | |
| ***.**********.com | United States | ***,*** | |
| *********.ru | Russia | ***,*** |