CVE-2020-4050: set-screen-option filter misuse by plugins leading to privilege escalation in WordPress

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-12 · updated 2026-06-17
Weakness: CWE-288

Description

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Affected products

Debian Linux: 8.0, 9.0, 10.0
Fedoraproject Fedora: 31, 32
WordPress: from 3.7 before 3.7.34; from 3.8 before 3.8.34; from 3.9 before 3.9.32; from 4.0 before 4.0.31; from 4.1 before 4.1.31; from 4.2 before 4.2.28 — fixed in 3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28

How to fix

Upgrade to a fixed version: WordPress 3.7.34, 3.8.34, 3.9.32, 4.0.31. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-4050 or the next vulnerability affects your stack