CVE-2020-36755

CVE-2020-36755 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Customizr theme for WordPress, affecting versions up to and including 4.3.0. This flaw stems from inadequate nonce validation in the czr_fn_post_fields_save() function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to unauthorized changes to post fields. The vulnerability has a CVSS score of 4.3 (Medium) with a low impact on integrity and no impact on confidentiality or availability, requiring user interaction for exploitation. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.