CVE-2020-4048
Estado: ModificadaMedia (5.7)—
En las versiones afectadas de WordPress, debido a un problema en la función wp_validate_redirect() y el saneamiento de URL, se puede crear un enlace externo arbitrario que puede conllevar a una redireccionamiento abierto involuntario al hacer clic. Esto ha sido parcheado en la versión 5.4.2, junto con todas las versiones afectadas anteriormente por medio de una versión menor (versiones 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34)
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- Puntuación base: 5.7
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.98%
- Percentil entre todas las CVEs puntuadas: 80
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-601
Referencias
- https://github.com/WordPress/wordpress-develop/commit/6ef777e9a022bee2a80fa671118e7e2657e52693
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-q6pw-gvf4-5fj5
- https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html
- https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/
- https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
- https://www.debian.org/security/2020/dsa-4709
- https://github.com/WordPress/wordpress-develop/commit/6ef777e9a022bee2a80fa671118e7e2657e52693
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-q6pw-gvf4-5fj5
- https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html
- https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/
- https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
- https://www.debian.org/security/2020/dsa-4709
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-4048",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.9,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.7,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.1
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.7,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.1
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "WordPress",
"product": "wordpress-develop",
"versions": [
{
"status": "affected",
"version": ">= 5.4.0, < 5.4.2"
},
{
"status": "affected",
"version": ">= 5.3.0, < 5.3.4"
},
{
"status": "affected",
"version": ">= 5.2.0, < 5.2.7"
},
{
"status": "affected",
"version": ">= 5.1.0, < 5.1.6"
},
{
"status": "affected",
"version": ">= 5.0.0, < 5.0.10"
},
{
"status": "affected",
"version": ">= 4.9.0, < 4.9.15"
},
{
"status": "affected",
"version": ">= 4.8.0, < 4.8.14"
},
{
"status": "affected",
"version": ">= 4.7.0, < 4.7.18"
},
{
"status": "affected",
"version": ">= 4.6.0, < 4.6.19"
},
{
"status": "affected",
"version": ">= 4.5.0, < 4.5.22"
},
{
"status": "affected",
"version": ">= 4.4.0, < 4.4.23"
},
{
"status": "affected",
"version": ">= 4.3.0, < 4.3.24"
},
{
"status": "affected",
"version": ">= 4.2.0, < 4.2.28"
},
{
"status": "affected",
"version": ">= 4.1.0, < 4.1.31"
},
{
"status": "affected",
"version": ">= 4.0.0, < 4.0.31"
},
{
"status": "affected",
"version": ">= 3.9.0, < 3.9.32"
},
{
"status": "affected",
"version": ">= 3.8.0, < 3.8.34"
},
{
"status": "affected",
"version": ">= 3.7.0, < 3.7.34"
}
]
}
]
}
],
"published": "2020-06-12T16:15:10.623",
"references": [
{
"url": "https://github.com/WordPress/wordpress-develop/commit/6ef777e9a022bee2a80fa671118e7e2657e52693",
"tags": [
"Patch"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-q6pw-gvf4-5fj5",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/",
"source": "security-advisories@github.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/",
"source": "security-advisories@github.com"
},
{
"url": "https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://www.debian.org/security/2020/dsa-4709",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/WordPress/wordpress-develop/commit/6ef777e9a022bee2a80fa671118e7e2657e52693",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-q6pw-gvf4-5fj5",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2020/dsa-4709",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-601"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34)."
},
{
"lang": "es",
"value": "En las versiones afectadas de WordPress, debido a un problema en la función wp_validate_redirect() y el saneamiento de URL, se puede crear un enlace externo arbitrario que puede conllevar a una redireccionamiento abierto involuntario al hacer clic. Esto ha sido parcheado en la versión 5.4.2, junto con todas las versiones afectadas anteriormente por medio de una versión menor (versiones 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34)"
}
],
"lastModified": "2026-06-17T03:19:29.193",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67D72FAA-7968-4A6C-AEEB-6E67B330C0F1",
"versionEndExcluding": "3.7.34",
"versionStartIncluding": "3.7"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "160A1456-677B-42B1-9559-895571365DB2",
"versionEndExcluding": "3.8.34",
"versionStartIncluding": "3.8"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82A1A5C0-148F-4AFD-A806-8A972D1D5257",
"versionEndExcluding": "3.9.32",
"versionStartIncluding": "3.9"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6266BB9D-8266-4E86-9955-9A73E2E9F365",
"versionEndExcluding": "4.0.31",
"versionStartIncluding": "4.0"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A34D6D45-363A-4426-8BED-A1850BCF658A",
"versionEndExcluding": "4.1.31",
"versionStartIncluding": "4.1"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5EAAF57C-586A-424A-8231-DCFB619829D2",
"versionEndExcluding": "4.2.28",
"versionStartIncluding": "4.2"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24F9EBD8-A2F0-447C-A3A4-BEAE0BB7C1D2",
"versionEndExcluding": "4.3.24",
"versionStartIncluding": "4.3"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19926F93-81E2-42CF-9367-3DECF5B3AB4B",
"versionEndExcluding": "4.4.23",
"versionStartIncluding": "4.4"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AAD6A986-8169-4B8A-9881-D7DA6B0F5E51",
"versionEndExcluding": "4.5.22",
"versionStartIncluding": "4.5"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20CB8A83-705A-41CD-A6CF-0D2E90A076CD",
"versionEndExcluding": "4.6.19",
"versionStartIncluding": "4.6"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "802504AF-67C7-4F98-8420-7F476CE13D71",
"versionEndExcluding": "4.7.18",
"versionStartIncluding": "4.7"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "021BC2EA-D165-47CA-B8A0-DA501086EC62",
"versionEndExcluding": "4.8.14",
"versionStartIncluding": "4.8"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51132C16-BA57-4241-A577-768089CB4B6E",
"versionEndExcluding": "4.9.15",
"versionStartIncluding": "4.9"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C9006BA-CBAF-4688-97A4-0AD6FFAACB85",
"versionEndExcluding": "5.0.10",
"versionStartIncluding": "5.0"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61356333-054E-4931-AA63-40AA5FC67F48",
"versionEndExcluding": "5.1.6",
"versionStartIncluding": "5.1"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F45140E-0E95-456B-ACB2-A01BB49485AD",
"versionEndExcluding": "5.2.7",
"versionStartIncluding": "5.2"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FAB63ED5-4756-4EA3-8AEB-951A47BEBDD4",
"versionEndExcluding": "5.3.4",
"versionStartIncluding": "5.3.0"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9673216-8B08-4144-832B-E51D66C595B5",
"versionEndExcluding": "5.4.2",
"versionStartIncluding": "5.4"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}