When was CVE-2020-28036 disclosed?

CVE-2020-28036 was first published in the National Vulnerability Database on November 2, 2020, with the most recent update on November 21, 2024. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.

Is CVE-2020-28036 actively exploited?

CVE-2020-28036 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 91.2% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.

What is the CVSS score of CVE-2020-28036?

CVE-2020-28036 has a CVSS v3 base score of 9.8 (NVD).

How do I remediate CVE-2020-28036?

Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2020-28036, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

CVE-2020-28036

CRITICALNVD 9.89.8—

9.8

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.

CVSS v3: 9.8
EG Score: 9.8(medium)
EPSS: 91.2%
KEV: Not listed

References (16)

cve@mitrehttps://github.com/WordPress/wordpress-develop/commit/c9e6b98968025b1629015998d12c3102165a7d32
cve@mitrehttps://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
cve@mitrehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
cve@mitrehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
cve@mitrehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
cve@mitrehttps://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
cve@mitrehttps://wpscan.com/vulnerability/10449
cve@mitrehttps://www.debian.org/security/2020/dsa-4784
af854a3a-2127-422b-91ae-364da2661108https://github.com/WordPress/wordpress-develop/commit/c9e6b98968025b1629015998d12c3102165a7d32
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
af854a3a-2127-422b-91ae-364da2661108https://wpscan.com/vulnerability/10449

Is Your Infrastructure Affected by CVE-2020-28036?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs

CVE-2020-28036

Published

Last Modified

References (16)

Weakness Classification(2)

Data Freshness Timeline

Frequently asked(5)

Dependency Blast Radius

Is Your Infrastructure Affected by CVE-2020-28036?

Same CWE

CVE-2020-28036

📅 Published

🔄 Last Modified

🔗 References (16)

Weakness Classification(2)

Data Freshness Timeline

❓ Frequently asked(5)

Dependency Blast Radius

Is Your Infrastructure Affected by CVE-2020-28036?

🔗 Related CVEs(same CWE)

Same CWE

Published

Last Modified

References (16)

Frequently asked(5)

Related CVEs(same CWE)