CVE-2020-36760: oceanwp ocean extra Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2020-36760 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in oceanwp ocean extra. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities. 8 public exploits are recorded. Fixed in 1.6.6.
Timeline
- 12-07-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the add_core_extensions_bundle_validation() function. This makes it possible for unauthenticated attackers to validate extension bundles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
8 foundExploit Reference (wordfence.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Show all 8 exploits
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Oceanwp1 product
- ocean extra< 1.6.6 | ≤ 1.6.5
Wordpress1 product
- ocean-extra< 1.6.6
2 vendors · 2 products
References
10 links- www.wordfence.com/threat-intel/vulnerabilities/id/eb3ef121-13ea-4e42-90c1-1f4bd31ebbcf?source=cveExploitPatchThird Party Advisory
- blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ExploitThird Party Advisory