CVE-2020-28037: WordPress RCE Vulnerability

CVE-2020-28037 Overview

CVE-2020-28037 is a critical vulnerability in WordPress affecting the is_blog_installed function in wp-includes/functions.php. This flaw allows attackers to bypass the WordPress installation check, potentially enabling them to perform a new installation on an already-configured WordPress site. Successful exploitation can lead to remote code execution (RCE) and complete site takeover, while simultaneously causing a denial of service for the existing WordPress installation.

Critical Impact

This vulnerability allows unauthenticated attackers to potentially execute arbitrary code and completely compromise WordPress installations by forcing a reinstallation, resulting in full site takeover and data loss.

Affected Products

• WordPress versions prior to 5.5.2
• Fedora 31, 32, and 33
• Debian Linux 10.0

Discovery Timeline

• November 2, 2020 - CVE-2020-28037 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-28037

Vulnerability Analysis

The vulnerability resides in the is_blog_installed() function within wp-includes/functions.php. This function is responsible for determining whether a WordPress installation has already been completed. Due to improper logic in evaluating the installation state, the function can incorrectly return a value indicating that WordPress is not yet installed, even when a valid installation exists.

This flaw creates a race condition or state confusion scenario where an attacker could exploit the improper check to trigger the WordPress installation wizard on an already-configured site. Once the installation wizard is accessible, the attacker can configure a new administrator account, overwrite the existing database configuration, and ultimately gain complete control over the WordPress instance.

The impact is twofold: first, the attacker achieves remote code execution capabilities through the newly created administrator account, which can upload malicious plugins or themes. Second, the original installation becomes inaccessible or corrupted, resulting in a denial of service for legitimate users and administrators.

Root Cause

The root cause is classified as CWE-754: Improper Check for Unusual or Exceptional Conditions. The is_blog_installed() function fails to properly validate all conditions that indicate a completed WordPress installation. This inadequate validation allows the installation process to be reinitiated under specific circumstances, bypassing the intended protection that should prevent reinstallation on configured sites.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can remotely access the WordPress installation endpoint and exploit the improper installation check to gain unauthorized access. The attack flow involves:

1. The attacker identifies a vulnerable WordPress installation (version < 5.5.2)
2. The attacker crafts requests that trigger the flawed is_blog_installed() check
3. If the check incorrectly returns that WordPress is not installed, the installation wizard becomes accessible
4. The attacker completes a new installation, creating admin credentials under their control
5. With admin access, the attacker can upload malicious code, modify content, or exfiltrate data

The vulnerability requires no special privileges or user interaction, making it highly exploitable in automated attack scenarios.

Detection Methods for CVE-2020-28037

Indicators of Compromise

• Unexpected access to WordPress installation pages (/wp-admin/install.php) on configured sites
• Sudden database connection errors or configuration changes without administrator action
• New administrator accounts appearing in the WordPress user database
• Modifications to wp-config.php or other core WordPress files
• Suspicious network requests targeting WordPress installation endpoints

Detection Strategies

• Monitor web server logs for requests to /wp-admin/install.php on established WordPress sites
• Implement file integrity monitoring for WordPress core files, especially wp-config.php
• Set up alerts for new administrator account creation events
• Deploy web application firewall (WAF) rules to block installation endpoint access on production sites
• Enable WordPress security plugins that monitor for unauthorized configuration changes

Monitoring Recommendations

• Implement real-time log analysis for WordPress access patterns and anomalies
• Configure alerts for any HTTP requests to WordPress setup or installation paths
• Monitor database tables for unexpected user creation or privilege escalation
• Use SentinelOne Singularity Platform to detect post-exploitation activities and malicious code execution
• Regularly audit WordPress user accounts and administrative access

How to Mitigate CVE-2020-28037

Immediate Actions Required

• Update WordPress to version 5.5.2 or later immediately
• Verify WordPress installation integrity using official checksums
• Review administrator accounts for any unauthorized users
• Check wp-config.php for unexpected modifications
• Implement network-level restrictions on WordPress installation endpoints

Patch Information

WordPress addressed this vulnerability in version 5.5.2, released in October 2020. The fix is documented in the GitHub WordPress Commit. Organizations should update to the latest WordPress version to receive this and subsequent security patches. The official WordPress Security Release provides additional details. Debian and Fedora users should apply updates through their respective package managers as documented in Debian Security Advisory DSA-4784.

Workarounds

• Restrict access to WordPress installation files at the web server level using .htaccess or nginx configuration
• Implement IP-based access controls for WordPress administrative endpoints
• Use a web application firewall to block requests to installation-related URLs
• Remove or rename wp-admin/install.php after initial installation (note: may affect future updates)
• Deploy file integrity monitoring to detect unauthorized changes to core WordPress files

# Apache .htaccess example to block installation endpoint access
<Files "install.php">
    Order Allow,Deny
    Deny from all
</Files>

# Nginx configuration to restrict installation endpoint
location ~* /wp-admin/install\.php$ {
    deny all;
    return 403;
}