CVE-2020-7947

9.8 criticalEPSS 2.8%

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-1236
Published: 2020-04-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

auth0:login_by_auth0

References

https://auth0.com/docs/cms/wordpress
https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0
https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v
https://wordpress.org/plugins/auth0/#developers
https://auth0.com/docs/cms/wordpress

Check your stack JSON