CVE-2018-20148

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

• CWE-502

• http://www.securityfocus.com/bid/106220Third Party Advisory, VDB Entry
• https://blog.secarma.co.uk/labs/near-phar-dangerous-unserialization-wherever-you-areExploit, Third Party Advisory
• https://codex.wordpress.org/Version_4.9.9Product, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/02/msg00019.htmlMailing List, Third Party Advisory
• https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/Release Notes, Vendor Advisory
• https://wordpress.org/support/wordpress-version/version-5-0-1/Release Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/9171Vendor Advisory
• https://www.debian.org/security/2019/dsa-4401Third Party Advisory
• https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/Press/Media Coverage, Third Party Advisory
• https://www.zdnet.com/article/wordpress-vulnerability-affects-a-third-of-most-popular-websites-online/Press/Media Coverage, Third Party Advisory
• http://www.securityfocus.com/bid/106220Third Party Advisory, VDB Entry
• https://blog.secarma.co.uk/labs/near-phar-dangerous-unserialization-wherever-you-areExploit, Third Party Advisory
• https://codex.wordpress.org/Version_4.9.9Product, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/02/msg00019.htmlMailing List, Third Party Advisory
• https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/Release Notes, Vendor Advisory
• https://wordpress.org/support/wordpress-version/version-5-0-1/Release Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/9171Vendor Advisory
• https://www.debian.org/security/2019/dsa-4401Third Party Advisory
• https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/Press/Media Coverage, Third Party Advisory
• https://www.zdnet.com/article/wordpress-vulnerability-affects-a-third-of-most-popular-websites-online/Press/Media Coverage, Third Party Advisory

Published

Dec 14, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20140Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vuln…
• CVE-2018-20141AbanteCart 1.2.12 has reflected cross-site scripting (XSS) v…
• CVE-2018-20144GitLab Community and Enterprise Edition 11.x before 11.3.13,…
• CVE-2018-20145Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if t…
• CVE-2018-20146An issue was discovered in Liquidware ProfileUnity before 6.…
• CVE-2018-20147In WordPress before 4.9.9 and 5.x before 5.0.1, authors coul…
• CVE-2018-20149In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apa…
• CVE-2018-2015IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote a…6.4
• CVE-2018-20150In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs…
• CVE-2018-20151In WordPress before 4.9.9 and 5.x before 5.0.1, the user-act…
• CVE-2018-20152In WordPress before 4.9.9 and 5.x before 5.0.1, authors coul…
• CVE-2018-20153In WordPress before 4.9.9 and 5.x before 5.0.1, contributors…