What the vulnerability does
01Description
In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Explanation of Vulnerability in Simple Terms
02Summary
WordPress 5.4.0 contains a scope-changed vulnerability affecting authenticated users with low privileges. An attacker with a low-privilege account can read or modify limited data across the site due to insufficient access controls. The vulnerability requires network access and an active login but does not require user interaction beyond the initial authentication.
What an attacker can do
03Attacker Capabilities
Read or modify limited data on the site with a low-privilege account.
Potential impact on your site
04Site Impact
Low-privilege user accounts can access or change data they should not be able to reach.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
April 30, 2020
CVE published
August 4, 2024
Record updated
