Gravity Forms plugin leak hashed passwords

ÉLEVÉE 7.5CVE-2020-13764 · GHSA-m983-q76g-cwpq · Published 02/06/2020 · updated 17/06/2026

En bref

CVE-2020-13764 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant wp-premium/gravityforms, gravityforms (rocketgenius).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.8%, plus élevée que 78.9% des vulnérabilités.
Correctif : mettre à jour vers 2.4.9 ou plus récent.

Package	Affected versions	Patched versions
wp-premium/gravityforms Packagist	`< 2.4.9`	`2.4.9`
gravityforms rocketgenius	`< 2.4.9`	`2.4.9`

Description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

NVD description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

References

nvd.nist.gov/vuln/detail/CVE-2020-13764 · ADVISORY
docs.gravityforms.com/gravityforms-change-log · WEB
wp-premium/gravityforms · PACKAGE
wp-premium/gravityforms · WEB
docs.gravityforms.com/gravityforms-change-log · Vendor Advisory

Autres vulnérabilités de wp-premium/gravityforms

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wp-premium/gravityforms

Packagist

< 2.4.9

2.4.9

gravityforms

rocketgenius

< 2.4.9

2.4.9

Description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

NVD description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

Autres vulnérabilités de wp-premium/gravityforms

Tout voir →