Critical severity · published Apr 1, 2020
CVE-2020-7947
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress
9.8
CVSS
2.8%
EPSS
No
On KEV
Description
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LB
Login BY Auth0 · Auth0
before 4.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7947
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7947
Product
https://auth0.com/docs/cms/wordpress
Third Party Advisory
https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0
Third Party Advisory
https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v
Release Notes
https://wordpress.org/plugins/auth0/#developers
More from Login BY Auth0
8.8
CVE-2020-7948
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress
6.1
CVE-2023-6813
Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
6.1
CVE-2020-6753
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392
6.1
CVE-2019-20173
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php