CVE-2020-28039: 
NixOS vulnerability analysis and mitigation

CVE-2020-28039 is a security vulnerability discovered in WordPress versions before 5.5.2, specifically affecting the is_protected_meta function in wp-includes/meta.php. The vulnerability was disclosed and patched in October 2020. The issue allows arbitrary file deletion because the function does not properly determine whether a meta key is considered protected (WordPress News, NVD).

The vulnerability stems from a security flaw in the is_protected_meta function within WordPress's meta handling system. The issue occurs because the function fails to properly validate and sanitize meta keys before determining their protection status. A fix was implemented that includes sanitizing the meta key before checking the protection status, as evidenced by the code changes in the WordPress repository (WordPress Commit).

The vulnerability allows attackers to perform arbitrary file deletion on affected WordPress installations. This could potentially lead to site disruption or data loss if successfully exploited (Debian Security, WPScan).

The vulnerability requires an attacker to have the ability to manipulate meta keys in WordPress. The issue was discovered by Slavco and confirmed by security researcher Karim El Ouerghemmi, indicating its exploitability was verified before public disclosure (WordPress News).

The vulnerability was fixed in WordPress version 5.5.2. Users are strongly recommended to upgrade to this version or later to protect against this security issue. The fix has been backported to various Linux distributions including Debian and Fedora (Debian Security, Fedora Update).