WordPress CVEs

Description

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

Affected WordPress components

• WordPress core
  Confirmed match
  Before 4.9.9; From 5.0 (including) to 5.0.1 (excluding)

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Before 4.9.9
• wordpress wordpress — From 5.0 (including) to 5.0.1 (excluding)

References

• www.securityfocus.com http://www.securityfocus.com/bid/106220 Third Party Advisory, VDB Entry
• blog.secarma.co.uk https://blog.secarma.co.uk/labs/near-phar-dangerous-unserialization-wherever-you-are Exploit, Third Party Advisory
• codex.wordpress.org https://codex.wordpress.org/Version_4.9.9 Product, Vendor Advisory
• lists.debian.org https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html Mailing List, Third Party Advisory
• wordpress.org https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/ Release Notes, Vendor Advisory
• wordpress.org https://wordpress.org/support/wordpress-version/version-5-0-1/ Release Notes, Vendor Advisory
• wpvulndb.com https://wpvulndb.com/vulnerabilities/9171 Vendor Advisory
• www.debian.org https://www.debian.org/security/2019/dsa-4401 Third Party Advisory
• www.zdnet.com https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/ Press/Media Coverage, Third Party Advisory
• www.zdnet.com https://www.zdnet.com/article/wordpress-vulnerability-affects-a-third-of-most-popular-websites-online/ Press/Media Coverage, Third Party Advisory
• nvd.nist.gov Official NVD record