CVE-2018-20148

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wpgetattachmentthumbfile function in wp-includes/post.php...

PT-2018-15269

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1 Description The issue arises from the mishandling of serialized data at phar:// URLs in the wp get attachment thumb file function, located in wp-includes/post.php. This...

CVE-2018-20148: Deserialization of Untrusted Data

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wpgetattachmentthumbfile function in wp-includes/post.php...