CVE-2020-4048CWE-601

Open redirect in wp_validate_redirect() in WordPress

Medium · published June 12, 2020

CVSS v3.1
5.7
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01978 · 80.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2020-06-12T16:00Z
EPSS history
Timeline
  • 12 JUN 16:00Z
    Open redirect in wp_validate_redirect() in WordPress
    cvelistv5