CVE-2020-36742

CVE-2020-36742 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Custom Field Template plugin for WordPress, affecting versions up to and including 2.5.1. This flaw stems from inadequate nonce validation within the edit_meta_value() function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to unauthorized modification of meta field values. The vulnerability is rated Medium severity with a CVSS score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating it can be exploited remotely with low attack complexity, requiring user interaction, and resulting in low impact to integrity. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.