CVE-2020-36736: 
WordPress vulnerability analysis and mitigation

CVE-2020-36736 affects the WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress in versions up to and including 1.5.15. The vulnerability was discovered and published on July 1, 2023. This security issue is classified as a Cross-Site Request Forgery (CSRF) vulnerability, with a CVSS v3.1 base score of 4.3 (MEDIUM) (NVD).

The vulnerability stems from missing or incorrect nonce validation on multiple functions including exportjson, importjson, and statuslogsfile. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (Wordfence).

The vulnerability allows unauthenticated attackers to import/export settings and trigger logs showing via forged requests. The impact is limited but requires tricking a site administrator into performing specific actions, such as clicking on a malicious link (NVD).

Users should update their WooCommerce Checkout & Funnel Builder by CartFlows plugin to a version newer than 1.5.15. A patch has been released to address the vulnerability by implementing proper nonce validation (WordPress Plugin).