CVE-2020-7947

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.

• CWE-1236

• https://auth0.com/docs/cms/wordpressProduct, Vendor Advisory
• https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0Third Party Advisory
• https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6vThird Party Advisory
• https://wordpress.org/plugins/auth0/#developersRelease Notes, Third Party Advisory
• https://auth0.com/docs/cms/wordpressProduct, Vendor Advisory
• https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0Third Party Advisory
• https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6vThird Party Advisory
• https://wordpress.org/plugins/auth0/#developersRelease Notes, Third Party Advisory

Published

Apr 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7940Missing password strength checks on some forms in Plone 4.3 …7.5
• CVE-2020-7941A privilege escalation issue in plone.app.contenttypes in Pl…9.8
• CVE-2020-7942Previously, Puppet operated on a model that a node with a va…6.5
• CVE-2020-7943Puppet Server and PuppetDB provide useful performance and de…7.5
• CVE-2020-7944In Continuous Delivery for Puppet Enterprise (CD4PE) before …7.7
• CVE-2020-7945Local registry credentials were included directly in the CD4…5.5
• CVE-2020-7948An issue was discovered in the Login by Auth0 plugin before …8.8
• CVE-2020-7949schemasystem.dll in Valve Dota 2 before 7.23f allows remote …7.8
• CVE-2020-7950meshsystem.dll in Valve Dota 2 before 7.23f allows remote at…7.8
• CVE-2020-7951meshsystem.dll in Valve Dota 2 before 7.23e allows remote at…7.8
• CVE-2020-7952rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remo…7.8
• CVE-2020-7953An issue was discovered in OpServices OpMon 9.3.2. Without a…7.5