CVE-2020-11027: Password reset links invalidation issue in WordPress
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this WordPress vulnerability?
The vulnerability ID for this WordPress vulnerability is CVE-2020-11027.
What is the severity level of CVE-2020-11027?
The severity level of CVE-2020-11027 is high.
What is the affected software for CVE-2020-11027?
The affected software for CVE-2020-11027 includes WordPress versions 3.7 to 5.4 and Debian Linux versions 8.0 to 10.0.
How can I fix CVE-2020-11027?
To fix CVE-2020-11027, you should update your WordPress installation to version 5.4.1 or later.
Where can I find more information about CVE-2020-11027?
You can find more information about CVE-2020-11027 on the following links: - [PacketStormSecurity](http://packetstormsecurity.com/files/173034/WordPress-Theme-Medic-1.0.0-Weak-Password-Recovery-Mechanism.html) - [GitHub Advisory](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ww7v-jg8c-q6jw) - [Debian LTS Announcement](https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html)