CVE-2020-28037 - is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation)

Back Back to CVE browser

CRITICAL

is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation)

Published Oct 31, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 8.07%

Description

is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-754

References (9)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-20528
Advisory
https://github.com/WordPress/wordpress-develop/commit/2ca15d1e5ce70493c5c0c096ca0c76503d6da07c
x_refsource_MISCPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
vendor-advisoryx_refsource_FEDORA
https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
x_refsource_MISCRelease NotesVendor Advisory
https://wpscan.com/vulnerability/10450
x_refsource_MISCThird Party Advisory
https://www.debian.org/security/2020/dsa-4784
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-20528		Advisory
https://github.com/WordPress/wordpress-develop/commit/2ca15d1e5ce70493c5c0c096ca0c76503d6da07c		x_refsource_MISCPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/		vendor-advisoryx_refsource_FEDORA
https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/		x_refsource_MISCRelease NotesVendor Advisory
https://wpscan.com/vulnerability/10450		x_refsource_MISCThird Party Advisory
https://www.debian.org/security/2020/dsa-4784		vendor-advisoryx_refsource_DEBIANThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 31, 2020

Updated Aug 4, 2024

Reserved Oct 31, 2020

Link CVE-2020-28037

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-28037

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Oct 31, 2020

Updated Aug 4, 2024

Link EUVD-2020-20528

GitHub

No data