WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact

WordPress Vulnerabilities

WordPress < 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation

Description

Props to Simon Scannell of RIPS Technologies for finding an issue where set-screen-option can be misused by plugins leading to privilege escalation.

Affects WordPress

5.4.1
Fixed in version 5.4.2
5.4
Fixed in version 5.4.2
5.3.3
Fixed in version 5.3.4
5.3.2
Fixed in version 5.3.4
5.3.1
Fixed in version 5.3.4
5.3
Fixed in version 5.3.4
5.2.6
Fixed in version 5.2.7
5.2.5
Fixed in version 5.2.7
5.2.4
Fixed in version 5.2.7
5.2.3
Fixed in version 5.2.7

References

CVE
CVE-2020-4050
URL
https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
URL
https://github.com/WordPress/WordPress/commit/dda0ccdd18f6532481406cabede19ae2ed1f575d
URL
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4vpv-fgg2-gcqc

Classification

Type

PRIVESC

OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269

Miscellaneous

Original Researcher

Simon Scannell (RIPS Technologies)

Verified

No

WPVDB ID
b6f69ff1-4c11-48d2-b512-c65168988c45

Timeline

Publicly Published

2020-06-11 (about 2 years ago)

Added

2020-06-11 (about 2 years ago)

Last Updated

2020-06-13 (about 2 years ago)

Our Other Services

WPScan WordPress Security Plugin