{"id":"CVE-2020-13764","details":"common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user-\u003eget($property) call.","aliases":["GHSA-m983-q76g-cwpq"],"modified":"2026-07-08T20:42:44.494411Z","published":"2020-06-02T21:15:10.670Z","references":[{"type":"ADVISORY","url":"https://docs.gravityforms.com/gravityforms-change-log/"},{"type":"ADVISORY","url":"https://github.com/wp-premium/gravityforms/compare/2.4.8...2.4.9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wp-premium/gravityforms","events":[{"introduced":"0"},{"fixed":"fe3a7fff2f2fda002d09b2f0e07c7bad3329a3dc"}],"database_specific":{"cpe":"cpe:2.3:a:rocketgenius:gravityforms:*:*:*:*:*:wordpress:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.4.9"}],"source":"CPE_RANGE"}}],"versions":["2.4.8","2.4.7.3","2.4.5","2.3.2","2.2.6.5","2.2.6","2.2.5","2.2.3","2.2.1","2.1.3","2.1.2","2.1.1","2.1.0.1","2.0.7","2.0.5","2.0.4","2.0.3","2.0.2","2.0.1","1.9.19","1.9.18","1.9.17.5","1.9.17","1.9.16","1.9.15","1.9.13.26","1.9.13.7","1.9.10.15","1.9.9.8","1.9.5.12","1.9.2","1.9.1.6","1.9","1.8.20.5","1.8.19","1.8.18","1.8.16","1.8.13","1.8.9","1.8.7.11","1.8.7.2","1.8.1","1.8","1.7.8","1.6.12"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13764.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}