CVE-2018-20148

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1

Description The issue arises from the mishandling of serialized data at phar:// URLs in the wp get attachment thumb file function, located in wp-includes/post.php. This allows contributors to conduct PHP object injection attacks via crafted metadata in a "wp.getMediaItem" XMLRPC call.

Recommendations For WordPress versions prior to 4.9.9, update to version 4.9.9 or later. For WordPress versions 5.x prior to 5.0.1, update to version 5.0.1 or later.