CVE-2020-4050

WordPress Core < 5.4.2 - Arbitrary User Meta Update

2020-06-10 00:00
Simon Scannell

Strategic Overview

Status
Patched in 3.7.34
Affected Core
WordPress 5.3
Affected Version
3.7 – 5.3.3 · 18 branches
CVSS
3.5Low
Weakness type
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
CVE
CVE-2020-4050
View all WordPress 5.3 vulnerabilities

At a glance

CVE-2020-4050 is a low-severity Authentication Bypass Using an Alternate Path or Channel vulnerability in the WordPress 5.3 WordPress release line, affecting 3.7 – 5.3.3 · 18 branches. It carries a CVSS score of 3.5 (reachable over the network). The issue is fixed in version 3.7.34; sites on affected versions should update now. Disclosed June 2020, reported by Simon Scannell.

Vulnerability Overview

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Technical Analysis

The vector marks this flaw as remotely reachable over the network, and no interaction from a victim user.

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Reaching this weakness in WordPress 5.3 3.7 – 5.3.3 · 18 branches takes a caller who can reach the endpoint. Authentication bypass through an alternate path means the application has a second route to a protected action that skips the checks the primary route performs.

The protection on the main path becomes irrelevant, because the attacker simply uses the route that never asks. For WordPress 5.3 the fix is 3.7.34: builds 3.7 – 5.3.3 · 18 branches are affected, anything from 3.7.34 onward is not.

Remediation

Update to one of the following versions, or a newer patched version: 3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2

How does WordSec protect against this?

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: updating to 3.7.34 is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2020-4050https://www.wordfence.com/threat-intel/vulnerabilities/id/8746bd3a-6e2b-4ed2-9b21-4ed5a0e58de8https://nvd.nist.gov/vuln/detail/CVE-2020-4050

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C