CVE-2018-20148 WordPress Core < 5.0.1 - PHP Object Injection
CriticalCVSS 9.8
EPSS 26.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| debian/wordpress(Debian:13) | < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| debian/wordpress(Debian:14) | < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| WordPress | < 4.9.9 | 4.9.9 |
| WordPress | >= 5.0, < 5.0.1 | 5.0.1 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| WordPress(WordPress) | < 3.7 | 3.7 |
| WordPress(WordPress) | >= 3.7, < 3.7.28 | 3.7.28 |
| WordPress(WordPress) | >= 3.8, < 3.8.28 | 3.8.28 |
| WordPress(WordPress) | >= 3.9, < 3.9.26 | 3.9.26 |
| WordPress(WordPress) | >= 4.0, < 4.0.25 | 4.0.25 |
| WordPress(WordPress) | >= 4.1, < 4.1.25 | 4.1.25 |
| WordPress(WordPress) | >= 4.2, < 4.2.22 | 4.2.22 |
| WordPress(WordPress) | >= 4.3, < 4.3.18 | 4.3.18 |
| WordPress(WordPress) | >= 4.4, < 4.4.17 | 4.4.17 |
| WordPress(WordPress) | >= 4.5, < 4.5.16 | 4.5.16 |
| WordPress(WordPress) | >= 4.6, < 4.6.13 | 4.6.13 |
| WordPress(WordPress) | >= 4.7, < 4.7.12 | 4.7.12 |
| WordPress(WordPress) | >= 4.8, < 4.8.8 | 4.8.8 |
| WordPress(WordPress) | >= 4.9, < 4.9.9 | 4.9.9 |
| WordPress(WordPress) | = 5.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-20148 vendor-advisory
- 106220 third-party-advisory vdb-entry
- blog.secarma.co.uk exploit third-party-advisory
- codex.wordpress.org product vendor-advisory
- [debian-lts-announce] 20190211 [SECURITY] [DLA 1673-1] wordpress security update mailing-list third-party-advisory
- wordpress.org release-notes vendor-advisory
- wordpress.org release-notes vendor-advisory
- wpvulndb.com vendor-advisory
- DSA-4401 third-party-advisory vendor-advisory
- www.zdnet.com press-media-coverage third-party-advisory
- www.zdnet.com press-media-coverage third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking