Gravity Forms plugin leak hashed passwords

ALTO 7.5CVE-2020-13764 · GHSA-m983-q76g-cwpq · Published 02/06/2020 · updated 17/06/2026

En resumen

CVE-2020-13764 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a wp-premium/gravityforms, gravityforms (rocketgenius).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.8%, mayor que el 78.9% de las vulnerabilidades.
Solución: actualizar a 2.4.9 o posterior.

Package	Affected versions	Patched versions
wp-premium/gravityforms Packagist	`< 2.4.9`	`2.4.9`
gravityforms rocketgenius	`< 2.4.9`	`2.4.9`

Description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

NVD description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

References

nvd.nist.gov/vuln/detail/CVE-2020-13764 · ADVISORY
docs.gravityforms.com/gravityforms-change-log · WEB
wp-premium/gravityforms · PACKAGE
wp-premium/gravityforms · WEB
docs.gravityforms.com/gravityforms-change-log · Vendor Advisory

Más vulnerabilidades de wp-premium/gravityforms

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wp-premium/gravityforms

Packagist

< 2.4.9

2.4.9

gravityforms

rocketgenius

< 2.4.9

2.4.9

Description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

NVD description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

Más vulnerabilidades de wp-premium/gravityforms

Ver todo →