CVE-2020-28037: WordPress RCE Vulnerability

CVE-2020-28037 Overview

CVE-2020-28037 is a critical vulnerability in WordPress affecting the is_blog_installed function in wp-includes/functions.php. This flaw allows attackers to bypass the WordPress installation check, potentially enabling them to perform a new installation on an already-configured WordPress site. Successful exploitation can lead to remote code execution (RCE) and complete site takeover, while simultaneously causing a denial of service for the existing WordPress installation.

Critical Impact
This vulnerability allows unauthenticated attackers to potentially execute arbitrary code and completely compromise WordPress installations by forcing a reinstallation, resulting in full site takeover and data loss.

Affected Products

WordPress versions prior to 5.5.2
Fedora 31, 32, and 33
Debian Linux 10.0

Discovery Timeline

November 2, 2020 - CVE-2020-28037 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-28037

Vulnerability Analysis

The vulnerability resides in the is_blog_installed() function within wp-includes/functions.php. This function is responsible for determining whether a WordPress installation has already been completed. Due to improper logic in evaluating the installation state, the function can incorrectly return a value indicating that WordPress is not yet installed, even when a valid installation exists.

This flaw creates a race condition or state confusion scenario where an attacker could exploit the improper check to trigger the WordPress installation wizard on an already-configured site. Once the installation wizard is accessible, the attacker can configure a new administrator account, overwrite the existing database configuration, and ultimately gain complete control over the WordPress instance.

The impact is twofold: first, the attacker achieves remote code execution capabilities through the newly created administrator account, which can upload malicious plugins or themes. Second, the original installation becomes inaccessible or corrupted, resulting in a denial of service for legitimate users and administrators.

Root Cause

The root cause is classified as CWE-754: Improper Check for Unusual or Exceptional Conditions. The is_blog_installed() function fails to properly validate all conditions that indicate a completed WordPress installation. This inadequate validation allows the installation process to be reinitiated under specific circumstances, bypassing the intended protection that should prevent reinstallation on configured sites.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can remotely access the WordPress installation endpoint and exploit the improper installation check to gain unauthorized access. The attack flow involves:

The attacker identifies a vulnerable WordPress installation (version < 5.5.2)
The attacker crafts requests that trigger the flawed is_blog_installed() check
If the check incorrectly returns that WordPress is not installed, the installation wizard becomes accessible
The attacker completes a new installation, creating admin credentials under their control
With admin access, the attacker can upload malicious code, modify content, or exfiltrate data

The vulnerability requires no special privileges or user interaction, making it highly exploitable in automated attack scenarios.

Detection Methods for CVE-2020-28037

Indicators of Compromise

Unexpected access to WordPress installation pages (/wp-admin/install.php) on configured sites
Sudden database connection errors or configuration changes without administrator action
New administrator accounts appearing in the WordPress user database
Modifications to wp-config.php or other core WordPress files
Suspicious network requests targeting WordPress installation endpoints

Detection Strategies

Monitor web server logs for requests to /wp-admin/install.php on established WordPress sites
Implement file integrity monitoring for WordPress core files, especially wp-config.php
Set up alerts for new administrator account creation events
Deploy web application firewall (WAF) rules to block installation endpoint access on production sites
Enable WordPress security plugins that monitor for unauthorized configuration changes

Monitoring Recommendations

Implement real-time log analysis for WordPress access patterns and anomalies
Configure alerts for any HTTP requests to WordPress setup or installation paths
Monitor database tables for unexpected user creation or privilege escalation
Use SentinelOne Singularity Platform to detect post-exploitation activities and malicious code execution
Regularly audit WordPress user accounts and administrative access

How to Mitigate CVE-2020-28037

Immediate Actions Required

Update WordPress to version 5.5.2 or later immediately
Verify WordPress installation integrity using official checksums
Review administrator accounts for any unauthorized users
Check wp-config.php for unexpected modifications
Implement network-level restrictions on WordPress installation endpoints

Patch Information

WordPress addressed this vulnerability in version 5.5.2, released in October 2020. The fix is documented in the GitHub WordPress Commit. Organizations should update to the latest WordPress version to receive this and subsequent security patches. The official WordPress Security Release provides additional details. Debian and Fedora users should apply updates through their respective package managers as documented in Debian Security Advisory DSA-4784.

Workarounds

Restrict access to WordPress installation files at the web server level using .htaccess or nginx configuration
Implement IP-based access controls for WordPress administrative endpoints
Use a web application firewall to block requests to installation-related URLs
Remove or rename wp-admin/install.php after initial installation (note: may affect future updates)
Deploy file integrity monitoring to detect unauthorized changes to core WordPress files

bash

# Apache .htaccess example to block installation endpoint access
<Files "install.php">
    Order Allow,Deny
    Deny from all
</Files>

# Nginx configuration to restrict installation endpoint
location ~* /wp-admin/install\.php$ {
    deny all;
    return 403;
}