CVE-2020-35135
Description
The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.2
Patches
Vulnerability mechanics
Root cause
"The plugin is vulnerable to Cross-Site Request Forgery (CSRF) because it lacks proper validation for user actions."
Attack vector
An attacker can exploit this vulnerability by tricking a logged-in administrator into visiting a crafted URL. This URL would trigger a request to the `ultimate-category-excluder.php` file, causing unintended changes to the plugin's settings without the user's knowledge or consent. The vulnerability is present because the plugin does not verify if the request originates from a legitimate user action within the WordPress admin interface [ref_id=1].
Affected code
The vulnerability resides within the `ultimate-category-excluder.php` file of the Ultimate Category Excluder WordPress plugin. Specifically, the plugin's handling of administrative actions related to category exclusion settings is susceptible to CSRF attacks [ref_id=1].
What the fix does
Version 1.2 of the Ultimate Category Excluder plugin addressed a minor vulnerability reported by SCA AppSec of Checkmarx [ref_id=1]. While the exact nature of the fix is not detailed in the provided changelog, it is implied that the update includes measures to prevent unauthorized modifications to the plugin's category exclusion settings. Users are advised to review their settings to ensure they are configured as expected after updating to version 1.2 or later [ref_id=1].
Preconditions
- authThe target user must be logged in as an administrator with privileges to modify plugin settings.
- inputThe attacker needs to craft a malicious URL that, when visited by the administrator, triggers the CSRF vulnerability.
Generated on Jun 4, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- advisory.checkmarx.net/advisory/CX-2020-4294mitrex_refsource_MISC
- plugins.trac.wordpress.org/changeset/2434070mitrex_refsource_MISC
- wordpress.org/plugins/ultimate-category-excluder/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.