CVE-2020-7948: 
WordPress vulnerability analysis and mitigation

An insecure direct object reference vulnerability was discovered in the Login by Auth0 plugin versions before 4.0.0 for WordPress. The vulnerability was identified and disclosed on April 1, 2020, with CVE identifier CVE-2020-7948. This security issue affected all versions of the WordPress Plugin for Auth0 3.11.3 and earlier (Auth0 Advisory, GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a serious security risk. The vulnerability allows authenticated users to perform unauthorized direct object reference operations (NVD).

The vulnerability could potentially allow authenticated users to access or modify unauthorized objects within the application, leading to potential data exposure or manipulation. The high CVSS score indicates that successful exploitation could result in significant compromise of system confidentiality, integrity, and availability (NVD).

Auth0 released version 4.0.0 of the WordPress Plugin as a fix for this vulnerability. Users are strongly recommended to upgrade to version 4.0.0 or higher to address this security issue (Auth0 Advisory).