CVE-2020-28032 (CRITICAL 9.8) · Watchpost

← All vulnerabilities

CVE-2020-28032

CRITICAL 9.8CVE-2020-28032 · Published 02/11/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
wordpress wordpress	`< 5.5.2`	`5.5.2`

Description

WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

References

WordPress/wordpress-develop commit add6bed · Patch
lists.debian.org/debian-lts-announce/2020/11/msg00004.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y
wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release · Release Notes
wpscan.com/vulnerability/10446 · Third Party Advisory
debian.org/security/2020/dsa-4784 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free