CVE-2020-4050
set-screen-option filter misuse by plugins leading to privilege escalation in WordPress
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
set-screen-option filter misuse by plugins leading to privilege escalation in WordPress
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- Record
CVE-2020-4050- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2020-25308
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- Record
EUVD-2020-25308- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-03
NVD
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- Record
CVE-2020-4050- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-288
- Updated
- 2026-11-02
OSV
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- Record
CVE-2020-4050- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-4050
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- Record
DEBIAN-CVE-2020-4050- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-4050
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- Record
UBUNTU-CVE-2020-4050- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVBIT-wordpress-2020-4050 No score
set-screen-option filter misuse by plugins leading to privilege escalation in WordPress
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- Record
BIT-wordpress-2020-4050- Updated
- 2026-11-02
OSVBIT-wordpress-multisite-2020-4050 No score
set-screen-option filter misuse by plugins leading to privilege escalation in WordPress
In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- Record
BIT-wordpress-multisite-2020-4050- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressBitnami |
3.7.0 up to 3.7.34, 3.8.0 up to 3.8.34, 3.9.0 up to 3.9.32, 4.0.0 up to 4.0.31, 4.1.0 up to 4.1.31, 4.2.0 up to 4.2.28, 4.3.0 up to 4.3.24, 4.4.0 up to 4.4.23, 4.5.0 up to 4.5.22, 4.6.0 up to 4.6.19, 4.7.0 up to 4.7.18, 4.8.0 up to 4.8.14, 4.9.0 up to 4.9.15, 5.0.0 up to 5.0.10, 5.1.0 up to 5.1.6, 5.2.0 up to 5.2.7, 5.3.0 up to 5.3.4, 5.4.0 up to 5.4.2 | 3.7.343.8.343.9.324.0.314.1.314.2.284.3.244.4.234.5.224.6.194.7.184.8.144.9.155.0.105.1.65.2.75.3.45.4.2 |
wordpress-multisiteBitnami |
3.7.0 up to 3.7.34, 3.8.0 up to 3.8.34, 3.9.0 up to 3.9.32, 4.0.0 up to 4.0.31, 4.1.0 up to 4.1.31, 4.2.0 up to 4.2.28, 4.3.0 up to 4.3.24, 4.4.0 up to 4.4.23, 4.5.0 up to 4.5.22, 4.6.0 up to 4.6.19, 4.7.0 up to 4.7.18, 4.8.0 up to 4.8.14, 4.9.0 up to 4.9.15, 5.0.0 up to 5.0.10, 5.1.0 up to 5.1.6, 5.2.0 up to 5.2.7, 5.3.0 up to 5.3.4, 5.4.0 up to 5.4.2 | 3.7.343.8.343.9.324.0.314.1.314.2.284.3.244.4.234.5.224.6.194.7.184.8.144.9.155.0.105.1.65.2.75.3.45.4.2 |
wordpressDebian:12 |
before 5.4.2+dfsg1-1 | 5.4.2+dfsg1-1 |
wordpressDebian:13 |
before 5.4.2+dfsg1-1 | 5.4.2+dfsg1-1 |
wordpressDebian:14 |
before 5.4.2+dfsg1-1 | 5.4.2+dfsg1-1 |
wordpressDebian:8 From an advisory covering 4 CVEs |
before 4.1.31+dfsg-0+deb8u1, plus listed versions 4.1+dfsg-14.1+dfsg-1+deb8u14.1+dfsg-1+deb8u104.1+dfsg-1+deb8u114.1+dfsg-1+deb8u12 Show 21 moreShow less4.1+dfsg-1+deb8u134.1+dfsg-1+deb8u144.1+dfsg-1+deb8u154.1+dfsg-1+deb8u164.1+dfsg-1+deb8u174.1+dfsg-1+deb8u184.1+dfsg-1+deb8u24.1+dfsg-1+deb8u34.1+dfsg-1+deb8u44.1+dfsg-1+deb8u54.1+dfsg-1+deb8u64.1+dfsg-1+deb8u74.1+dfsg-1+deb8u84.1+dfsg-1+deb8u94.1.1+dfsg-14.1.25+dfsg-1+deb8u14.1.26+dfsg-1+deb8u14.1.27+dfsg-0+deb8u14.1.28+dfsg-0+deb8u14.1.29+dfsg-0+deb8u14.1.30+dfsg-0+deb8u1 |
4.1.31+dfsg-0+deb8u1 |
wordpressDebian:9 From an advisory covering 6 CVEs |
before 4.7.18+dfsg-1+deb9u1, plus listed versions 4.7.5+dfsg-24.7.5+dfsg-2+deb9u14.7.5+dfsg-2+deb9u1~bpo8+14.7.5+dfsg-2+deb9u24.7.5+dfsg-2+deb9u2~bpo8+1 Show 4 moreShow less4.7.5+dfsg-2+deb9u34.7.5+dfsg-2+deb9u44.7.5+dfsg-2+deb9u54.7.5+dfsg-2+deb9u6 |
4.7.18+dfsg-1+deb9u1 |
wordpressDebian:10 From an advisory covering 5 CVEs |
before 5.0.10+dfsg1-0+deb10u1, plus listed versions 5.0.4+dfsg1-15.0.4+dfsg1-1+deb10u15.0.4+dfsg1-1+deb10u2 |
5.0.10+dfsg1-0+deb10u1 |
wordpressUbuntu:16.04:LTS |
All versions, plus listed versions 4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1 |
None known |
wordpressUbuntu:18.04:LTS |
All versions, plus listed versions 4.8.2+dfsg-24.8.3+dfsg-14.9.1+dfsg-14.9.2+dfsg-14.9.4+dfsg-14.9.5+dfsg1-1 |
None known |
wordpressUbuntu:20.04:LTS |
All versions, plus listed versions 5.2.2+dfsg1-15.2.4+dfsg1-15.3.2+dfsg1-15.3.2+dfsg1-1ubuntu1 |
None known |
wordpressUbuntu:22.04:LTS |
All versions, plus listed versions 5.7.1+dfsg1-2ubuntu15.8.1+dfsg1-2ubuntu15.8.2+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu1.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-4050 is a low vulnerability (CVSS 3.5) in Wordpress, published June 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in wordpress 3.7.34.
References
wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release
github.com/WordPress/wordpress-develop/security/advisories/GHSA-4vpv-fgg2-gcqc
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN
debian.org/security/2020/dsa-4709
Show 7 moreShow less
lists.debian.org/debian-lts-announce/2020/07/msg00000.html
nvd.nist.gov/vuln/detail/CVE-2020-4050
security-tracker.debian.org/tracker/CVE-2020-4050
ubuntu.com/security/CVE-2020-4050
core.trac.wordpress.org/changeset/47951
cve.org/CVERecord?id=CVE-2020-4050