Gravity Forms plugin leak hashed passwords

ALTO 7.5CVE-2020-13764 · GHSA-m983-q76g-cwpq · Published 02/06/2020 · updated 17/06/2026

Em resumo

CVE-2020-13764 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta wp-premium/gravityforms, gravityforms (rocketgenius).
Chance de exploração nos próximos 30 dias (EPSS): 1.8%, maior que 78.9% das vulnerabilidades.
Correção: atualize para 2.4.9 ou posterior.

Package	Affected versions	Patched versions
wp-premium/gravityforms Packagist	`< 2.4.9`	`2.4.9`
gravityforms rocketgenius	`< 2.4.9`	`2.4.9`

Description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

NVD description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

References

nvd.nist.gov/vuln/detail/CVE-2020-13764 · ADVISORY
docs.gravityforms.com/gravityforms-change-log · WEB
wp-premium/gravityforms · PACKAGE
wp-premium/gravityforms · WEB
docs.gravityforms.com/gravityforms-change-log · Vendor Advisory

Mais vulnerabilidades de wp-premium/gravityforms

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wp-premium/gravityforms

Packagist

< 2.4.9

2.4.9

gravityforms

rocketgenius

< 2.4.9

2.4.9

Description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

NVD description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

Mais vulnerabilidades de wp-premium/gravityforms

Ver tudo →