CVE-2020-4050

LOW

set-screen-option filter misuse by plugins leading to privilege escalation in WordPress

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2020-4050 has a selected CVSS score of 3.5 (low).

Description

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Description source: CVE List

Affected products and versions

1
ProductSourceVersion range

wordpress-develop

Browse WordPress / wordpress-develop
CVE List>= 5.4.0, < 5.4.2affected
>= 5.3.0, < 5.3.4affected
>= 5.2.0, < 5.2.7affected
>= 5.1.0, < 5.1.6affected
>= 5.0.0, < 5.0.10affected
>= 4.9.0, < 4.9.15affected
>= 4.8.0, < 4.8.14affected
>= 4.7.0, < 4.7.18affected
>= 4.6.0, < 4.6.19affected
>= 4.5.0, < 4.5.22affected
>= 4.4.0, < 4.4.23affected
>= 4.3.0, < 4.3.24affected
Showing 12 of 18 version ranges

References

8