CVE-2020-7947

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-01 · updated 2026-06-17
Weakness: CWE-1236

Description

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.

Affected products

auth0 Login by Auth0: before 4.0.0 — fixed in 4.0.0

How to fix

Upgrade to a fixed version: auth0 Login by Auth0 4.0.0. Check the vendor advisory for mitigations.

References

https://auth0.com/docs/cms/wordpress
https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0
https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v
https://wordpress.org/plugins/auth0/#developers
https://auth0.com/docs/cms/wordpress
https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0
https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v
https://wordpress.org/plugins/auth0/#developers

Get alerted when CVE-2020-7947 or the next vulnerability affects your stack