CVE-2020-36750: 
WordPress vulnerability analysis and mitigation

CVE-2020-36750 affects the EWWW Image Optimizer WordPress plugin versions up to and including 5.8.1. The vulnerability was discovered by Jerome Bruandet from NinTechNet and was publicly disclosed on September 6, 2020. This Cross-Site Request Forgery (CSRF) vulnerability exists due to missing or incorrect nonce validation in the ewwwnggbulk_init() function (NVD, WPScan).

The vulnerability stems from improper nonce validation in the ewwwnggbulk_init() function, which is responsible for handling bulk image optimization operations. The CVSS v3.1 score for this vulnerability is 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (Wordfence).

If successfully exploited, this vulnerability allows unauthenticated attackers to perform bulk image optimization operations through forged requests. The attack requires user interaction, as the attacker must trick a site administrator into clicking on a malicious link or performing a specific action (NVD).

The vulnerability has been fixed in version 5.9 of the EWWW Image Optimizer plugin. Site administrators are strongly recommended to update to this version or later to protect against this vulnerability (WPScan).