phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

CVE-2020-4050: In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse

low Affects WordPress core. Feed 2026.10.29.1, updated 2026-10-28; published ; advisory modified .

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse

Package
WordPress core WordPress
Affected versions
>=3.7 and <3.7.34 or >=3.8 and <3.8.34 or >=3.9 and <3.9.32 or >=4.0 and <4.0.31 or >=4.1 and <4.1.31 or >=4.2 and <4.2.28 or >=4.3 and <4.3.24 or >=4.4 and <4.4.23 or >=4.5 and <4.5.22 or >=4.6 and <4.6.19 or >=4.7 and <4.7.18 or >=4.8 and <4.8.14 or >=4.9 and <4.9.15 or >=5.0 and <5.0.10 or >=5.1 and <5.1.6 or >=5.2 and <5.2.7 or >=5.3.0 and <5.3.4 or >=5.4 and <5.4.2
Fixed in
3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
Severity
low  CVSS 3.5
Exploitation
not on CISA KEV · EPSS 1% (72.6th percentile)
Published
2020-06-12
Source
nvd

References

CWE-288
NVD recordWordPress core advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs   How findings are ranked

Related advisories