set-screen-option filter misuse by plugins leading to privilege escalation in WordPress

3.5 CVSS

Vulnerability Description

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-4050

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from WordPress

View All →

CVE-2025-58674

WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

Medium 5.9

CVE-2025-58246

WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Medium 4.3

CVE-2025-54352

WordPress 3.5 through 6.8.2 allows remote attackers to guess titles...

Low 3.7

CVE-2024-31211

Remote Code Execution in `WP_HTML_Token`

Medium 5.5

CVE-2024-31210

PHP file upload bypass via Plugin installer

High 7.7

Affected Vendor

WordPress

View all reports →

Affected Software

wordpress-develop

Vulnerable Versions:

>= 5.4.0, < 5.4.2, >= 5.3.0, < 5.3.4, >= 5.2.0, < 5.2.7, >= 5.1.0, < 5.1.6, >= 5.0.0, < 5.0.10, >= 4.9.0, < 4.9.15, >= 4.8.0, < 4.8.14, >= 4.7.0, < 4.7.18, >= 4.6.0, < 4.6.19, >= 4.5.0, < 4.5.22, >= 4.4.0, < 4.4.23, >= 4.3.0, < 4.3.24, >= 4.2.0, < 4.2.28, >= 4.1.0, < 4.1.31, >= 4.0.0, < 4.0.31, >= 3.9.0, < 3.9.32, >= 3.8.0, < 3.8.34, >= 3.7.0, < 3.7.34