phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

CVE-2020-4048: In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has

medium Affects WordPress core. Feed 2026.10.29.4, updated 2026-10-29; published ; advisory modified .

In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has

Package
WordPress core WordPress
Affected versions
>=3.7 and <3.7.34 or >=3.8 and <3.8.34 or >=3.9 and <3.9.32 or >=4.0 and <4.0.31 or >=4.1 and <4.1.31 or >=4.2 and <4.2.28 or >=4.3 and <4.3.24 or >=4.4 and <4.4.23 or >=4.5 and <4.5.22 or >=4.6 and <4.6.19 or >=4.7 and <4.7.18 or >=4.8 and <4.8.14 or >=4.9 and <4.9.15 or >=5.0 and <5.0.10 or >=5.1 and <5.1.6 or >=5.2 and <5.2.7 or >=5.3.0 and <5.3.4 or >=5.4 and <5.4.2
Fixed in
3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 2% (80.5th percentile)
Published
2020-06-12
Source
nvd

References

CWE-601
NVD recordWordPress core advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs   How findings are ranked

Related advisories