Description

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

Remediation

References

CVE-2018-20148

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9507)

WordPress Plugin Media Library Assistant Multiple Cross-Site Scripting Vulnerabilities (2.73)

WordPress Plugin Backup by Supsystic Local File Inclusion (2.3.9)

WordPress Plugin AI ChatBot Information Disclosure (4.8.9)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Cross-Site Scripting (3.0.17)

Severity

Critical

Classification

CVE-2018-20148 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities