CVE-2020-4050
mediumpriority · track · 12OT risk · elevatedEPSS 0.014 · 73 %ileEUUSEPSS · scored 2026-10-26
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.9–6
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (77)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- BIT-wordpress-2020-4050set-screen-option filter misuse by plugins leading to privilege escalation in WordPress2024-03-06vendor · osvUS
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- BIT-wordpress-multisite-2020-4050set-screen-option filter misuse by plugins leading to privilege escalation in WordPress2024-03-06vendor · osvUS
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
also known as (5)
Other names and identifiers for this entity.
- CNNVD-202006-987cnnvd
- EUVD-2020-25308enisa_euvd
- BIT-wordpress-2020-4050osv
- BIT-wordpress-multisite-2020-4050osv
- GHSA-4vpv-fgg2-gcqcosv
sources
Which sources assert this record, and when.
references (28)
External citations — patches, advisories, analysis.
- https://github.com/WordPress/wordpress-develop/commit/b8dea76b495f0072523106c6ec46b9ea0d2a0920cnnvd
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4vpv-fgg2-gcqccnnvd
- https://lists.debian.org/debian-lts-announce/2020/07/msg00000.htmlcnnvd
- https://lists.debian.org/debian-lts-announce/2020/09/msg00011.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-4050cnnvd
- https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan