CVE-2020-11028
Estado: ModificadaAlta (7.5)—
En las versiones afectadas de WordPress, algunas publicaciones privadas, que anteriormente eran públicas, pueden resultar en una divulgación no autenticada bajo un conjunto específico de condiciones. Esto ha sido corregido en la versión 5.4.1, junto con todas las versiones afectadas anteriormente mediante una versión menor (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.32%
- Percentil entre todas las CVEs puntuadas: 83
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-284
- CWE-306
Referencias
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w
- https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html
- https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates
- https://www.debian.org/security/2020/dsa-4677
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w
- https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html
- https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates
- https://www.debian.org/security/2020/dsa-4677
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-11028",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5.8,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 4,
"exploitabilityScore": 1.3
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "WordPress",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": ">= 5.4.0, < 5.4.1"
},
{
"status": "affected",
"version": ">= 5.3.0, < 5.3.3"
},
{
"status": "affected",
"version": ">= 5.2.0, < 5.2.6"
},
{
"status": "affected",
"version": ">= 5.1.0, < 5.1.5"
},
{
"status": "affected",
"version": ">= 5.0.0, < 5.0.9"
},
{
"status": "affected",
"version": ">= 4.9.0, < 4.9.14"
},
{
"status": "affected",
"version": ">= 4.8.0, < 4.8.13"
},
{
"status": "affected",
"version": ">= 4.7.0, < 4.7.17"
},
{
"status": "affected",
"version": ">= 4.6.0, < 4.6.18"
},
{
"status": "affected",
"version": ">= 4.5.0, < 4.5.21"
},
{
"status": "affected",
"version": ">= 4.4.0, < 4.4.22"
},
{
"status": "affected",
"version": ">= 4.3.0, < 4.3.23"
},
{
"status": "affected",
"version": ">= 4.2.0, < 4.2.27"
},
{
"status": "affected",
"version": ">= 4.1.0, < 4.1.30"
},
{
"status": "affected",
"version": ">= 4.0.0, < 4.0.30"
},
{
"status": "affected",
"version": ">= 3.9.0, < 3.9.31"
},
{
"status": "affected",
"version": ">= 3.8.0, < 3.8.33"
},
{
"status": "affected",
"version": ">= 3.7.0, < 3.7.33"
}
]
}
]
}
],
"published": "2020-04-30T23:15:11.683",
"references": [
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://www.debian.org/security/2020/dsa-4677",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2020/dsa-4677",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33)."
},
{
"lang": "es",
"value": "En las versiones afectadas de WordPress, algunas publicaciones privadas, que anteriormente eran públicas, pueden resultar en una divulgación no autenticada bajo un conjunto específico de condiciones. Esto ha sido corregido en la versión 5.4.1, junto con todas las versiones afectadas anteriormente mediante una versión menor (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33)."
}
],
"lastModified": "2026-06-17T02:48:53.893",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E79CBDF-EE25-487C-8276-74F4928ECDFF",
"versionEndExcluding": "5.4.1"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}