Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

releasealert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

Privacy Policy
Terms of Service
Contact

CVE-2020-28036 — CRITICAL severity vulnerability | Release Alert

CVE-2020-28036

9.8

CRITICALCVSS v3

Published

November 2, 2020

CVSS v2

7.5 HIGH

Affected

10 projects

Assigned by

MITRE

Severity scale

010

Description

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.

WordPress/WordPress

GitHubWordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Please do not send pull requests. Submit pull requests to https://github.com/WordPress/wordpress-develop and patches to https://core.trac.wordpress.org/ instead.

< 5.5.2NVD

WordPress/wordpress-develop

GitHubWordPress Develop, Git-ified. Synced from git://develop.git.wordpress.org/, including branches and tags! This repository is just a mirror of the WordPress subversion repository. Please include a link to a pre-existing ticket on https://core.trac.wordpress.org/ with every pull request.

NVD

More on this CVE

NVD↗GitHub Advisory↗

auth0/wordpress

GitHubWordPress Plugin for Auth0 Authentication

< 5.5.2NVD

wordpress

NPMA client for working with WordPress.

< 5.5.2NVD

wordpress

RubyGemsThe Wordpress gem provides posting to a Wordpress.com blog or a self hosted wordpress by providing your username, password, login url(if you host your blog) and your blog content. With this gem, you have access to add a text entry on Wordpress blog by providing these options: title text, body text, and a tag array. You must include at least title text or body text with your post. Posting images with posts, posting only images and pulling down your posts will be available very soon.

< 5.5.2NVD