CVE-2020-4050 set-screen-option filter misuse by plugins leading to privilege escalation in WordPress

Low 3.5 Published 12 Jun 2020 Updated 4 Aug 2024

Low-privileged users can escalate privileges by exploiting a filter misuse in WordPress when a vulnerable plugin is installed.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-4050?

CVE-2020-4050 is a low-severity vulnerability in Debian Debian Linux, published on 12 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Weakness: CWE-288

Which versions are affected by CVE-2020-4050?

2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 3 products.

Package	Affected	Fixed in
`wordpress` Bitnami	From `3.7.0`	`3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2`
`wordpress-multisite` Bitnami	From `3.7.0`	`3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2`

Products include Debian Debian Linux, Fedoraproject Fedora, Wordpress Wordpress.

How do I fix CVE-2020-4050?

Upgrade wordpress to a fixed version for your release line: 3.7.34, 3.8.34, 3.9.32 or 4.0.31.

Is CVE-2020-4050 being exploited?

There is no known exploitation of CVE-2020-4050 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as BIT-wordpress-2020-4050, BIT-wordpress-multisite-2020-4050, DEBIAN-CVE-2020-4050, GHSA-4vpv-fgg2-gcqc, UBUNTU-CVE-2020-4050.