Search for vulnerabilities
Vulnerability details: VCID-q6fq-uwx9-wugu
Vulnerability ID VCID-q6fq-uwx9-wugu
Aliases CVE-2020-4050
Summary In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Status Published
Exploitability 0.5
Weighted Severity 5.4
Risk 2.7
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.01398 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01398 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01398 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
epss 0.01821 https://api.first.org/data/v1/epss?cve=CVE-2020-4050
cvssv2 6.0 https://nvd.nist.gov/vuln/detail/CVE-2020-4050
cvssv3.1 3.1 https://nvd.nist.gov/vuln/detail/CVE-2020-4050
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-4050
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25286
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4047
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4048
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4049
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4050
https://github.com/WordPress/wordpress-develop/commit/b8dea76b495f0072523106c6ec46b9ea0d2a0920
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4vpv-fgg2-gcqc
https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/
https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
https://www.debian.org/security/2020/dsa-4709
962685 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962685
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
CVE-2020-4050 https://nvd.nist.gov/vuln/detail/CVE-2020-4050
No exploits are available.
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2020-4050
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-4050
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.79701
EPSS Score 0.01398
Published At Aug. 1, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T10:09:52.985524+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2020-4050 37.0.0