PT-2018-15272

CVE-2018-20151

Published

2018-12-14

Updated

2019-03-04

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1

Description The user-activation page could be accessed by a search engine's web crawler under certain configurations, potentially allowing the search engine to index and display a user's e-mail address and, in rare cases, the default-generated password.

Recommendations For WordPress versions prior to 4.9.9, update to version 4.9.9 or later. For WordPress versions 5.x prior to 5.0.1, update to version 5.0.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2018-20151

DLA-1673-1