Woody code snippets <= 2.3.9 - Cross-Site Request Forgery Bypass
Priority LOW 21CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00476 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts (themeisle): 2.3.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| themeisle | Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts | before 2.3.10 | 2.3.10 | Patch available | CNA |
- Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts Vendorthemeisle Affected before 2.3.10 Fixed in 2.3.10 Patch available CNA
Remediation
- Fix · CNA Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts (themeisle) Fixed in 2.3.10
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36759
- 2026-10-03 Alias added: GHSA-g3px-65r8-wfgx
References
Other 6
- https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/
More themeisle vulnerabilities
- TI-2017-14315 WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API CVSS 4.0CRITICAL 9.3
- TI-2023-02146 Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization CVSS 3.1HIGH 8.8
- TI-2023-20819 WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
- TI-2019-12631 A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via… CVSS 3.1CRITICAL 10.0
- TI-2023-02115 Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2022-04265 RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
Sources
- CVE-2020-36759 · CVE Program
- CVE-2020-36759 · NVD
- FIRST EPSS
- GHSA-g3px-65r8-wfgx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences