BIT-wordpress-multisite-2020-25286

vendorUSosv

view advisory published 2024-03-06Licence: per source

In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-25286US	medium5.3	1.91% (80th)	—	2020-09-13
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.

references

External citations — patches, advisories, analysis.

https://core.trac.wordpress.org/changeset/47984ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-25286WEB
https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan