CVE catalog

CVE-2020-4050

wordpress affected and fixed versions

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Severity: Low · CVSS 3.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Published: Jun 12, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.41% · Oct 27, 2026

Projects and upstream resources

[wordpress][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	wordpress	`6.8.10+dfsg1-0+deb13u1`	Fixed	[CVE-2020-4050]
Debiantrixie	wordpress	`5.4.2+dfsg1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-4050]
Debiantrixie	wordpress	`6.8.7+dfsg1-0+deb13u1`	Fixed	[CVE-2020-4050]
Debiansid	wordpress	`5.4.2+dfsg1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-4050]
Debiansid	wordpress	`7.1.3+dfsg1-1`	Fixed	[CVE-2020-4050]
Debianforky	wordpress	`5.4.2+dfsg1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-4050]
Debianforky	wordpress	`7.1.3+dfsg1-1`	Fixed	[CVE-2020-4050]
Debianbookworm-security	wordpress	`6.1.9+dfsg1-0+deb12u1`	Fixed	[CVE-2020-4050]
Debianbookworm	wordpress	`5.4.2+dfsg1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-4050]
Debianbookworm	wordpress	`6.1.9+dfsg1-0+deb12u1`	Fixed	[CVE-2020-4050]

Showing 10 fix observations. All 31 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	wordpress	`5.4.2+dfsg1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-4050]
Debianbookworm	wordpress	`6.1.9+dfsg1-0+deb12u1`	Fixed	[CVE-2020-4050]
Debianbookworm-security	wordpress	`6.1.9+dfsg1-0+deb12u1`	Fixed	[CVE-2020-4050]
Debianforky	wordpress	`5.4.2+dfsg1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-4050]
Debianforky	wordpress	`7.1.3+dfsg1-1`	Fixed	[CVE-2020-4050]
Debiansid	wordpress	`5.4.2+dfsg1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-4050]
Debiansid	wordpress	`7.1.3+dfsg1-1`	Fixed	[CVE-2020-4050]
Debiantrixie	wordpress	`5.4.2+dfsg1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-4050]
Debiantrixie	wordpress	`6.8.7+dfsg1-0+deb13u1`	Fixed	[CVE-2020-4050]
Debiantrixie-security	wordpress	`6.8.10+dfsg1-0+deb13u1`	Fixed	[CVE-2020-4050]
Ubuntu16.04	wordpress	`4.3+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu16.04	wordpress	`4.3.1+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu16.04	wordpress	`4.4+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu16.04	wordpress	`4.4.1+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu16.04	wordpress	`4.4.2+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu16.04	wordpress	`4.4.2+dfsg-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu18.04	wordpress	`4.8.2+dfsg-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu18.04	wordpress	`4.8.3+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu18.04	wordpress	`4.9.1+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu18.04	wordpress	`4.9.2+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu18.04	wordpress	`4.9.4+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu18.04	wordpress	`4.9.5+dfsg1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu20.04	wordpress	`5.2.2+dfsg1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu20.04	wordpress	`5.2.4+dfsg1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu20.04	wordpress	`5.3.2+dfsg1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu20.04	wordpress	`5.3.2+dfsg1-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu22.04	wordpress	`5.7.1+dfsg1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu22.04	wordpress	`5.8.1+dfsg1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu22.04	wordpress	`5.8.2+dfsg1-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu22.04	wordpress	`5.8.3+dfsg1-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC
Ubuntu22.04	wordpress	`5.8.3+dfsg1-1ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-4050]Oct 24, 2025, 4:48:16 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "wordpress",
      "status": "fixed",
      "release": "sid",
      "version": "7.1.3+dfsg1-1"
    },
    {
      "name": "wordpress",
      "status": "fixed",
      "release": "forky",
      "version": "7.1.3+dfsg1-1"
    },
    {
      "name": "wordpress",
      "status": "fixed",
      "release": "trixie",
      "version": "6.8.7+dfsg1-0+deb13u1"
    },
    {
      "name": "wordpress",
      "status": "fixed",
      "release": "trixie-security",
      "version": "6.8.10+dfsg1-0+deb13u1"
    },
    {
      "name": "wordpress",
      "status": "fixed",
      "release": "bookworm",
      "version": "6.1.9+dfsg1-0+deb12u1"
    },
    {
      "name": "wordpress",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "6.1.9+dfsg1-0+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 962685,
      "name": "wordpress",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.2+dfsg1-1"
    },
    {
      "bug": 962685,
      "name": "wordpress",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.2+dfsg1-1"
    },
    {
      "bug": 962685,
      "name": "wordpress",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.2+dfsg1-1"
    },
    {
      "bug": 962685,
      "name": "wordpress",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.2+dfsg1-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "wordpress",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "4.3+dfsg-1",
        "4.3.1+dfsg-1",
        "4.4+dfsg-1",
        "4.4.1+dfsg-1",
        "4.4.2+dfsg-1",
        "4.4.2+dfsg-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-4050",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-4050",
      "provider_updated_at": "2025-10-24T04:48:16Z",
      "applicability_unknown": true
    },
    {
      "name": "wordpress",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "4.8.2+dfsg-2",
        "4.8.3+dfsg-1",
        "4.9.1+dfsg-1",
        "4.9.2+dfsg-1",
        "4.9.4+dfsg-1",
        "4.9.5+dfsg1-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-4050",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-4050",
      "provider_updated_at": "2025-10-24T04:48:16Z",
      "applicability_unknown": true
    },
    {
      "name": "wordpress",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "5.2.2+dfsg1-1",
        "5.2.4+dfsg1-1",
        "5.3.2+dfsg1-1",
        "5.3.2+dfsg1-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-4050",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-4050",
      "provider_updated_at": "2025-10-24T04:48:16Z",
      "applicability_unknown": true
    },
    {
      "name": "wordpress",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "5.7.1+dfsg1-2ubuntu1",
        "5.8.1+dfsg1-2ubuntu1",
        "5.8.2+dfsg1-1ubuntu1",
        "5.8.3+dfsg1-1ubuntu1",
        "5.8.3+dfsg1-1ubuntu1.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-4050",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-4050",
      "provider_updated_at": "2025-10-24T04:48:16Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #962685]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[wordpress]Unknown
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
[wordpress-l10n]Unknown
Source package: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
[wordpress-theme-twentytwentyone]Unknown
Source package: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
[wordpress-theme-twentytwentythree]Unknown
Source package: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
[wordpress-theme-twentytwentytwo]Unknown
Source package: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · bookworm; dsa · wordpress · debian · 12

[Debian 13 (Trixie)]

[wordpress]Unknown
Details (6)
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.10+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
[wordpress-l10n]Unknown
Source package: [wordpress]
Details (6)
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.10+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
[wordpress-theme-twentytwentyfive]Unknown
Source package: [wordpress]
Details (6)
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.10+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
[wordpress-theme-twentytwentyfour]Unknown
Source package: [wordpress]
Details (6)
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.10+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
[wordpress-theme-twentytwentythree]Unknown
Source package: [wordpress]
Details (6)
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.3+dfsg1-0+deb13u1 · all · trixie
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.10+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13
- 6.8.7+dfsg1-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 5.4.2+dfsg1-1
  dsa · wordpress · debian · 13

Observed: Oct 23, 2026, 5:52:49 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]