WordPress core

CVE-2020-25286

In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.

Severity: Medium 5.3
Published: 13 Sept 2020
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.4.2
Sources: NVD

Affected software

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	Every version before 5.4.2

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2020-25286
CVE.org https://www.cve.org/CVERecord?id=CVE-2020-25286