CVE-2020-28037
📋 TL;DR
This vulnerability in WordPress allows attackers to trigger a fresh installation on an already installed WordPress site, potentially leading to remote code execution and denial of service. It affects WordPress installations before version 5.5.2. The flaw exists in the is_blog_installed function which improperly determines installation status.
💻 Affected Systems
- WordPress
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Wordpress by Wordpress
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains remote code execution on the server, potentially compromising the entire WordPress installation and underlying system.
Likely Case
Attacker resets WordPress installation, causing denial of service and potential data loss or unauthorized access.
If Mitigated
If proper access controls and monitoring are in place, the attack would be detected and blocked before successful exploitation.
🎯 Exploit Status
Exploitation requires network access to WordPress installation but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WordPress 5.5.2 and later
Vendor Advisory: https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
Restart Required: No
Instructions:
1. Backup WordPress site and database. 2. Update WordPress core to version 5.5.2 or later via WordPress admin dashboard or manual update. 3. Verify update completed successfully.
🔧 Temporary Workarounds
Restrict WordPress Installation Access
allBlock access to WordPress installation scripts via web server configuration
# For Apache: Add to .htaccess
RewriteRule ^wp-admin/install\.php$ - [F,L]
# For Nginx: Add to server block
location ~ ^/wp-admin/install\.php$ { return 403; }
🧯 If You Can't Patch
- Implement strict network access controls to limit access to WordPress admin interface
- Enable comprehensive logging and monitoring for installation attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress version in admin dashboard or wp-includes/version.php file. If version is below 5.5.2, system is vulnerable.Check Version:
grep '\$wp_version' wp-includes/version.phpVerify Fix Applied:
Verify WordPress version is 5.5.2 or higher and test installation functionality is not accessible.📡 Detection & Monitoring
Log Indicators:
- Multiple requests to wp-admin/install.php
- Database installation/creation attempts
- Unexpected WordPress setup processes
Network Indicators:
- HTTP requests to /wp-admin/install.php from unusual sources
- Database connection attempts from web server
SIEM Query:
source="web_access_logs" AND (uri="/wp-admin/install.php" OR uri="/wp-admin/setup-config.php")🔗 References
- https://github.com/WordPress/wordpress-develop/commit/2ca15d1e5ce70493c5c0c096ca0c76503d6da07c
- https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
- https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
- https://wpscan.com/vulnerability/10450
- https://www.debian.org/security/2020/dsa-4784
- https://github.com/WordPress/wordpress-develop/commit/2ca15d1e5ce70493c5c0c096ca0c76503d6da07c
- https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
- https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
- https://wpscan.com/vulnerability/10450
- https://www.debian.org/security/2020/dsa-4784
