CVE-2020-25286 Information disclosure in n/a
Attackers can view comments from non-public posts or pages in the latest comments widget, exposing private content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25286?
CVE-2020-25286 is a medium-severity vulnerability in Wordpress Wordpress, published on 13 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.
Which versions are affected by CVE-2020-25286?
2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wordpress Bitnami | All versions | 5.4.2 |
wordpress-multisite Bitnami | All versions | 5.4.2 |
Products include Wordpress Wordpress.
How do I fix CVE-2020-25286?
Upgrade wordpress to 5.4.2 or later.
Is CVE-2020-25286 being exploited?
There is no known exploitation of CVE-2020-25286 in the wild and no public exploit code.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as BIT-wordpress-2020-25286, BIT-wordpress-multisite-2020-25286, DEBIAN-CVE-2020-25286, GHSA-8ggp-4pf2-5mgh, UBUNTU-CVE-2020-25286.