In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
07 Nov 2023, 03:23
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2020-06-12 16:15
Updated : 2024-02-28 17:47
NVD link : CVE-2020-4050
Mitre link : CVE-2020-4050
CVE.ORG link : CVE-2020-4050
JSON object : View
Products Affected
fedoraproject
- fedora
debian
- debian_linux
wordpress
- wordpress
CWE
CWE-288
Authentication Bypass Using an Alternate Path or Channel