UpHeron
All vulnerabilities

WordPress core

CVE-2020-11027

Password reset links invalidation issue in WordPress

Severity
High 8.1
Published
30 Apr 2020
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1
Also known as
GHSA-ww7v-jg8c-q6jw
Sources
NVD, WordPress

Description

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18,…

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Version 5.4
  • From 5.3 before 5.3.3
  • From 5.2 before 5.2.6
  • From 5.1 before 5.1.5
All 19 release lines
  • From 3.7 before 3.7.33
  • From 3.7 before 5.4.1
  • From 3.8 before 3.8.33
  • From 3.9 before 3.9.31
  • From 4.0 before 4.0.30
  • From 4.1 before 4.1.30
  • From 4.2 before 4.2.27
  • From 4.3 before 4.3.23
  • From 4.4 before 4.4.22
  • From 4.5 before 4.5.21
  • From 4.6 before 4.6.18
  • From 4.7 before 4.7.17
  • From 4.8 before 4.8.13
  • From 4.9 before 4.9.14
  • From 5.0 before 5.0.9
  • From 5.1 before 5.1.5
  • From 5.2 before 5.2.6
  • From 5.3 before 5.3.3
  • Version 5.4

References