| Package | Affected versions | Patched versions |
|---|---|---|
| wordpress | ≥ 5.0, < 5.0.1< 4.9.9 | 5.0.14.9.9 |
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free