In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - Six cross-site scripting (XSS) vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.

 - A remote unauthenticated user can view certain private posts.

 - Password reset tokens were not properly invalidated.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple CVE(s) were discovered in the src:wordpress package.

CVE-2020-11026

Files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files.

CVE-2020-11027

A password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution.

CVE-2020-11028

Some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions.

CVE-2020-11029

A vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks.

For Debian 8 'Jessie', these problems have been fixed in version 4.1.30+dfsg-0+deb8u1.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation.

ID	Name	Product	Family	Severity
112420	WordPress 5.4.x < 5.4.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112419	WordPress 5.3.x < 5.3.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112418	WordPress 5.2.x < 5.2.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112410	WordPress 5.1.x < 5.1.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112409	WordPress 5.0.x < 5.0.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112408	WordPress 4.9.x < 4.9.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112407	WordPress 4.8.x < 4.8.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112406	WordPress 4.7.x < 4.7.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112405	WordPress 4.6.x < 4.6.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112404	WordPress 4.5.x < 4.5.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112403	WordPress 4.4.x < 4.4.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112402	WordPress 4.3.x < 4.3.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112401	WordPress 4.2.x < 4.2.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112400	WordPress 4.1.x < 4.1.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112399	WordPress 4.0.x < 4.0.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112398	WordPress 3.9.x < 3.9.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112390	WordPress 3.8.x < 3.8.33 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112389	WordPress 3.7.x < 3.7.33 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
136484	Debian DLA-2208-1 : wordpress security update	Nessus	Debian Local Security Checks	high
136373	Debian DSA-4677-1 : wordpress - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-11027

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical