blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2020-11027

HIGH 8.1 CVSS 3.1
Published
April 30, 2020
Last modified
June 17, 2026
NVD status
Modified
Reported by
security-advisories@github.com
Weakness
CWE-672, CWE-640
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Affected WordPress components

  • WordPress core
    Confirmed match
    From 3.7 (including) to 3.7.33 (excluding); From 3.8 (including) to 3.8.33 (excluding); From 3.9 (including) to 3.9.31 (excluding); From 4.0 (including) to 4.0.30 (excluding); From 4.1 (including) to 4.1.30 (excluding); From 4.2 (including) to 4.2.27 (excluding); From 4.3 (including) to 4.3.23 (excluding); From 4.4 (including) to 4.4.22 (excluding); From 4.5 (including) to 4.5.21 (excluding); From 4.6 (including) to 4.6.18 (excluding); From 4.7 (including) to 4.7.17 (excluding); From 4.8 (including) to 4.8.13 (excluding); From 4.9 (including) to 4.9.14 (excluding); From 5.0 (including) to 5.0.9 (excluding); From 5.1 (including) to 5.1.5 (excluding); From 5.2 (including) to 5.2.6 (excluding); From 5.3 (including) to 5.3.3 (excluding); Version 5.4
  • wordpress Plugin · wordpress
    Possible match Homeless
    Version >= 5.4.0, < 5.4.1; Version >= 5.3.0, < 5.3.3; Version >= 5.2.0, < 5.2.6; Version >= 5.1.0, < 5.1.5; Version >= 5.0.0, < 5.0.9; Version >= 4.9.0, < 4.9.14; Version >= 4.8.0, < 4.8.13; Version >= 4.7.0, < 4.7.17; Version >= 4.6.0, < 4.6.18; Version >= 4.5.0, < 4.5.21; Version >= 4.4.0, < 4.4.22; Version >= 4.3.0, < 4.3.23; Version >= 4.2.0, < 4.2.27; Version >= 4.1.0, < 4.1.30; Version >= 4.0.0, < 4.0.30; Version >= 3.9.0, < 3.9.31; Version >= 3.8.0, < 3.8.33; Version >= 3.7.0, < 3.7.33
    View on WordPress.org
  • wordpress Theme · wordpress
    Possible match Homeless
    Version >= 5.4.0, < 5.4.1; Version >= 5.3.0, < 5.3.3; Version >= 5.2.0, < 5.2.6; Version >= 5.1.0, < 5.1.5; Version >= 5.0.0, < 5.0.9; Version >= 4.9.0, < 4.9.14; Version >= 4.8.0, < 4.8.13; Version >= 4.7.0, < 4.7.17; Version >= 4.6.0, < 4.6.18; Version >= 4.5.0, < 4.5.21; Version >= 4.4.0, < 4.4.22; Version >= 4.3.0, < 4.3.23; Version >= 4.2.0, < 4.2.27; Version >= 4.1.0, < 4.1.30; Version >= 4.0.0, < 4.0.30; Version >= 3.9.0, < 3.9.31; Version >= 3.8.0, < 3.8.33; Version >= 3.7.0, < 3.7.33
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • WordPress WordPress — Version >= 5.4.0, < 5.4.1
  • WordPress WordPress — Version >= 5.3.0, < 5.3.3
  • WordPress WordPress — Version >= 5.2.0, < 5.2.6
  • WordPress WordPress — Version >= 5.1.0, < 5.1.5
  • WordPress WordPress — Version >= 5.0.0, < 5.0.9
  • WordPress WordPress — Version >= 4.9.0, < 4.9.14
  • WordPress WordPress — Version >= 4.8.0, < 4.8.13
  • WordPress WordPress — Version >= 4.7.0, < 4.7.17
  • WordPress WordPress — Version >= 4.6.0, < 4.6.18
  • WordPress WordPress — Version >= 4.5.0, < 4.5.21
  • WordPress WordPress — Version >= 4.4.0, < 4.4.22
  • WordPress WordPress — Version >= 4.3.0, < 4.3.23
  • WordPress WordPress — Version >= 4.2.0, < 4.2.27
  • WordPress WordPress — Version >= 4.1.0, < 4.1.30
  • WordPress WordPress — Version >= 4.0.0, < 4.0.30
  • WordPress WordPress — Version >= 3.9.0, < 3.9.31
  • WordPress WordPress — Version >= 3.8.0, < 3.8.33
  • WordPress WordPress — Version >= 3.7.0, < 3.7.33
  • wordpress wordpress — From 3.7 (including) to 3.7.33 (excluding)
  • wordpress wordpress — From 3.8 (including) to 3.8.33 (excluding)
  • wordpress wordpress — From 3.9 (including) to 3.9.31 (excluding)
  • wordpress wordpress — From 4.0 (including) to 4.0.30 (excluding)
  • wordpress wordpress — From 4.1 (including) to 4.1.30 (excluding)
  • wordpress wordpress — From 4.2 (including) to 4.2.27 (excluding)
  • wordpress wordpress — From 4.3 (including) to 4.3.23 (excluding)
  • wordpress wordpress — From 4.4 (including) to 4.4.22 (excluding)
  • wordpress wordpress — From 4.5 (including) to 4.5.21 (excluding)
  • wordpress wordpress — From 4.6 (including) to 4.6.18 (excluding)
  • wordpress wordpress — From 4.7 (including) to 4.7.17 (excluding)
  • wordpress wordpress — From 4.8 (including) to 4.8.13 (excluding)
  • wordpress wordpress — From 4.9 (including) to 4.9.14 (excluding)
  • wordpress wordpress — From 5.0 (including) to 5.0.9 (excluding)
  • wordpress wordpress — From 5.1 (including) to 5.1.5 (excluding)
  • wordpress wordpress — From 5.2 (including) to 5.2.6 (excluding)
  • wordpress wordpress — From 5.3 (including) to 5.3.3 (excluding)
  • wordpress wordpress — Version 5.4

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/173034/WordPress-Theme-Medic-1.0.0-Weak-Password-Recovery-Mechanism.html
  • github.com https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ww7v-jg8c-q6jw Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html Mailing List, Third Party Advisory
  • wordpress.org https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates Release Notes, Vendor Advisory
  • www.debian.org https://www.debian.org/security/2020/dsa-4677 Third Party Advisory
  • nvd.nist.gov Official NVD record