CVE-2020-11028: Unauthenticated disclosure of certain private posts in WordPress
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this WordPress vulnerability?
The vulnerability ID for this WordPress vulnerability is CVE-2020-11028.
What is the severity level of CVE-2020-11028?
The severity level of CVE-2020-11028 is high with a severity score of 7.5.
Which versions of WordPress are affected by CVE-2020-11028?
Versions up to and inclusive of 5.4.1 of WordPress are affected by CVE-2020-11028.
How can I fix CVE-2020-11028?
To fix CVE-2020-11028, you should update WordPress to version 5.4.1 or later.
Where can I find more information about CVE-2020-11028?
You can find more information about CVE-2020-11028 on the following references: [Link 1](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w), [Link 2](https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html), [Link 3](https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates).