PT-2020-3603 · WordPress · Wordpress
Nguyen The Duc
·
Published
2020-04-30
·
Updated
2024-03-06
·
CVE-2020-11028
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
WordPress versions prior to 5.4.1
WordPress versions 5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33
Description
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. The vulnerability is related to the
parse query method in the class-wp-query.php file and is associated with a lack of protection for service data. This may allow a remote attacker to gain access to confidential data.Recommendations
For versions prior to 5.4.1, update to version 5.4.1 or later to resolve the issue.
For versions 5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33, consider updating to a newer version that includes the security patch.
As a temporary workaround, consider restricting access to private posts until the issue is resolved.
Fix
Improper Access Control
Missing Authentication
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wordpress