01 Record

CVE-2020-11028

Unauthenticated disclosure of certain private posts in WordPress

MediumPUBLISHEDCNA: GitHub_M

CNA base score5.8 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

View raw JSON

02 Description

Unauthenticated disclosure of certain private posts in WordPress

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 2.32% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 83.3% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2020-04-30 22:15Z6 YR AGO

Last updated

2024-08-04 11:21Z2 YR AGO

Reserved

2020-03-30

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

Medium (CVSS 5.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Weaknesses

CWE-284Improper Access ControlPillar
CWE-306Missing Authentication for Critical FunctionBase

Data version

5.1

Document digest

596237ca3fd1b5783e065d0c9a49f5fc0c96d22268fefa785d38848e9e19cd83

05 Affected products

VendorProductVersionsPlatforms

WordPressWordPress>= 5.4.0, < 5.4.1, >= 5.3.0, < 5.3.3, >= 5.2.0, < 5.2.6, >= 5.1.0, < 5.1.5, >= 5.0.0, < 5.0.9, >= 4.9.0, < 4.9.14, >= 4.8.0, < 4.8.13, >= 4.7.0, < 4.7.17, >= 4.6.0, < 4.6.18, >= 4.5.0, < 4.5.21, >= 4.4.0, < 4.4.22, >= 4.3.0, < 4.3.23, >= 4.2.0, < 4.2.27, >= 4.1.0, < 4.1.30, >= 4.0.0, < 4.0.30, >= 3.9.0, < 3.9.31, >= 3.8.0, < 3.8.33, >= 3.7.0, < 3.7.33—

06 References

wordpress.orghttps://wordpress.org/support/wordpress-version/version-5-4-1/#security-updatesx_refsource_MISC
github.comhttps://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2wx_refsource_CONFIRM
www.debian.orgDSA-4677https://www.debian.org/security/2020/dsa-4677vendor-advisoryx_refsource_DEBIAN
lists.debian.org[debian-lts-announce] 20200511 [SECURITY] [DLA 2208-1] wordpress security updatehttps://lists.debian.org/debian-lts-announce/2020/05/msg00011.htmlmailing-listx_refsource_MLIST

07 Fixed in

Debian 12

wordpress
Fixed in 5.4.1+dfsg1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

wordpress
Fixed in 5.4.1+dfsg1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

wordpress
Fixed in 5.4.1+dfsg1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.