Object Injection

wordpress is vulnerable to PHP object injection. The vulnerability exists in the wpgetattachmentthumbfile function in wp-includes/post.php because the attack can be triggered by inputting manipulated metadata. in the wpgetattachmentthumbfile function in wp-includes/post.php...

PT-2018-15269

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1 Description The issue arises from the mishandling of serialized data at phar:// URLs in the wp get attachment thumb file function, located in wp-includes/post.php. This...

CVE-2015-2213: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the wpuntrashpostcomments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash...

CVE-2011-3128

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php...

CVE-2011-3128

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php...

CVE-2011-3128: Exposure of Sensitive Information to an Unauthorized Actor

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php...

PT-2011-4259

Name of the Vulnerable Software and Affected Versions WordPress versions 3.1 through 3.1.2 WordPress versions 3.2 before Beta 2 Description The issue allows remote attackers to obtain sensitive data via vectors related to wp-includes/post.php, specifically by treating unattached attachments as...