WordPress Vulnerabilities

WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer

Description

WordPress versions 3.7 to 5.7.1 were using a vulnerable version of the PHPMailer library, which was affected by a PHP Object Injection vulnerability through Phar Deserialization via addAttachment with a UNC pathname.

To fix the vulnerability the PHPMailer library was updated from version 6.4.0 to 6.4.1.

The PHPMailer library developers state that, "PHPMailer versions between 6.1.8 and 6.4.0 contain a regression of the earlier CVE-2018-19296 object injection vulnerability as a result of a fix for Windows UNC paths in 6.1.8. Recorded as CVE-2020-36326. Reported by Fariskhi Vidyan via Tidelift. 6.4.1 fixes this issue, and also enforces stricter checks for URL schemes in local path contexts."

To ensure that your WordPress website is secure against this vulnerability, update to version 5.7.2, or another patched minor version listed below.

Affects WordPress

5.7.1
Fixed in WordPress 5.7.2
5.7
Fixed in WordPress 5.7.2
5.6.3
Fixed in WordPress 5.6.4
5.6.2
Fixed in WordPress 5.6.4
5.6.1
Fixed in WordPress 5.6.4
5.6
Fixed in WordPress 5.6.4
5.5.4
Fixed in WordPress 5.5.5
5.5.3
Fixed in WordPress 5.5.5
5.5.2
Fixed in WordPress 5.5.5
5.5.1
Fixed in WordPress 5.5.5
5.5
Fixed in WordPress 5.5.5
5.4.5
Fixed in WordPress 5.4.6
5.4.4
Fixed in WordPress 5.4.6
5.4.3
Fixed in WordPress 5.4.6
5.4.2
Fixed in WordPress 5.4.6
5.4.1
Fixed in WordPress 5.4.6
5.4
Fixed in WordPress 5.4.6
5.3.7
Fixed in WordPress 5.3.8
5.3.6
Fixed in WordPress 5.3.8
5.3.5
Fixed in WordPress 5.3.8
5.3.4
Fixed in WordPress 5.3.8
5.3.3
Fixed in WordPress 5.3.8
5.3.2
Fixed in WordPress 5.3.8
5.3.1
Fixed in WordPress 5.3.8
5.3
Fixed in WordPress 5.3.8
5.2.10
Fixed in WordPress 5.2.11
5.2.9
Fixed in WordPress 5.2.11
5.2.8
Fixed in WordPress 5.2.11
5.2.7
Fixed in WordPress 5.2.11
5.2.6
Fixed in WordPress 5.2.11
5.2.5
Fixed in WordPress 5.2.11
5.2.4
Fixed in WordPress 5.2.11
5.2.3
Fixed in WordPress 5.2.11
5.2.2
Fixed in WordPress 5.2.11
5.2.1
Fixed in WordPress 5.2.11
5.2
Fixed in WordPress 5.2.11
5.1.9
Fixed in WordPress 5.1.10
5.1.8
Fixed in WordPress 5.1.10
5.1.7
Fixed in WordPress 5.1.10
5.1.6
Fixed in WordPress 5.1.10
5.1.5
Fixed in WordPress 5.1.10
5.1.4
Fixed in WordPress 5.1.10
5.1.3
Fixed in WordPress 5.1.10
5.1.2
Fixed in WordPress 5.1.10
5.1.1
Fixed in WordPress 5.1.10
5.1
Fixed in WordPress 5.1.10
5.0.12
Fixed in WordPress 5.0.13
5.0.11
Fixed in WordPress 5.0.13
5.0.10
Fixed in WordPress 5.0.13
5.0.9
Fixed in WordPress 5.0.13
5.0.8
Fixed in WordPress 5.0.13
5.0.7
Fixed in WordPress 5.0.13
5.0.6
Fixed in WordPress 5.0.13
5.0.4
Fixed in WordPress 5.0.13
5.0.3
Fixed in WordPress 5.0.13
5.0.2
Fixed in WordPress 5.0.13
5.0.1
Fixed in WordPress 5.0.13
5.0
Fixed in WordPress 5.0.13
4.9.17
Fixed in WordPress 4.9.18
4.9.16
Fixed in WordPress 4.9.18
4.9.15
Fixed in WordPress 4.9.18
4.9.14
Fixed in WordPress 4.9.18
4.9.13
Fixed in WordPress 4.9.18
4.9.12
Fixed in WordPress 4.9.18
4.9.11
Fixed in WordPress 4.9.18
4.9.10
Fixed in WordPress 4.9.18
4.9.9
Fixed in WordPress 4.9.18
4.9.8
Fixed in WordPress 4.9.18
4.9.7
Fixed in WordPress 4.9.18
4.9.6
Fixed in WordPress 4.9.18
4.9.5
Fixed in WordPress 4.9.18
4.9.4
Fixed in WordPress 4.9.18
4.9.3
Fixed in WordPress 4.9.18
4.9.2
Fixed in WordPress 4.9.18
4.9.1
Fixed in WordPress 4.9.18
4.9
Fixed in WordPress 4.9.18
4.8.16
Fixed in WordPress 4.8.17
4.8.15
Fixed in WordPress 4.8.17
4.8.14
Fixed in WordPress 4.8.17
4.8.13
Fixed in WordPress 4.8.17
4.8.12
Fixed in WordPress 4.8.17
4.8.11
Fixed in WordPress 4.8.17
4.8.10
Fixed in WordPress 4.8.17
4.8.9
Fixed in WordPress 4.8.17
4.8.8
Fixed in WordPress 4.8.17
4.8.7
Fixed in WordPress 4.8.17
4.8.6
Fixed in WordPress 4.8.17
4.8.5
Fixed in WordPress 4.8.17
4.8.4
Fixed in WordPress 4.8.17
4.8.3
Fixed in WordPress 4.8.17
4.8.2
Fixed in WordPress 4.8.17
4.8.1
Fixed in WordPress 4.8.17
4.8
Fixed in WordPress 4.8.17
4.7.20
Fixed in WordPress 4.7.21
4.7.19
Fixed in WordPress 4.7.21
4.7.18
Fixed in WordPress 4.7.21
4.7.17
Fixed in WordPress 4.7.21
4.7.16
Fixed in WordPress 4.7.21
4.7.15
Fixed in WordPress 4.7.21
4.7.14
Fixed in WordPress 4.7.21
4.7.13
Fixed in WordPress 4.7.21
4.7.12
Fixed in WordPress 4.7.21
4.7.11
Fixed in WordPress 4.7.21
4.7.10
Fixed in WordPress 4.7.21
4.7.9
Fixed in WordPress 4.7.21
4.7.8
Fixed in WordPress 4.7.21
4.7.7
Fixed in WordPress 4.7.21
4.7.6
Fixed in WordPress 4.7.21
4.7.5
Fixed in WordPress 4.7.21
4.7.4
Fixed in WordPress 4.7.21
4.7.3
Fixed in WordPress 4.7.21
4.7.2
Fixed in WordPress 4.7.21
4.7.1
Fixed in WordPress 4.7.21
4.7
Fixed in WordPress 4.7.21
4.6.20
Fixed in WordPress 4.6.21
4.6.19
Fixed in WordPress 4.6.21
4.6.18
Fixed in WordPress 4.6.21
4.6.17
Fixed in WordPress 4.6.21
4.6.16
Fixed in WordPress 4.6.21
4.6.15
Fixed in WordPress 4.6.21
4.6.14
Fixed in WordPress 4.6.21
4.6.13
Fixed in WordPress 4.6.21
4.6.12
Fixed in WordPress 4.6.21
4.6.11
Fixed in WordPress 4.6.21
4.6.10
Fixed in WordPress 4.6.21
4.6.9
Fixed in WordPress 4.6.21
4.6.8
Fixed in WordPress 4.6.21
4.6.7
Fixed in WordPress 4.6.21
4.6.6
Fixed in WordPress 4.6.21
4.6.5
Fixed in WordPress 4.6.21
4.6.4
Fixed in WordPress 4.6.21
4.6.3
Fixed in WordPress 4.6.21
4.6.2
Fixed in WordPress 4.6.21
4.6.1
Fixed in WordPress 4.6.21
4.6
Fixed in WordPress 4.6.21
4.5.23
Fixed in WordPress 4.5.24
4.5.22
Fixed in WordPress 4.5.24
4.5.21
Fixed in WordPress 4.5.24
4.5.20
Fixed in WordPress 4.5.24
4.5.19
Fixed in WordPress 4.5.24
4.5.18
Fixed in WordPress 4.5.24
4.5.17
Fixed in WordPress 4.5.24
4.5.16
Fixed in WordPress 4.5.24
4.5.15
Fixed in WordPress 4.5.24
4.5.14
Fixed in WordPress 4.5.24
4.5.13
Fixed in WordPress 4.5.24
4.5.12
Fixed in WordPress 4.5.24
4.5.11
Fixed in WordPress 4.5.24
4.5.10
Fixed in WordPress 4.5.24
4.5.9
Fixed in WordPress 4.5.24
4.5.8
Fixed in WordPress 4.5.24
4.5.7
Fixed in WordPress 4.5.24
4.5.6
Fixed in WordPress 4.5.24
4.5.5
Fixed in WordPress 4.5.24
4.5.4
Fixed in WordPress 4.5.24
4.5.3
Fixed in WordPress 4.5.24
4.5.2
Fixed in WordPress 4.5.24
4.5.1
Fixed in WordPress 4.5.24
4.5
Fixed in WordPress 4.5.24
4.4.24
Fixed in WordPress 4.4.25
4.4.23
Fixed in WordPress 4.4.25
4.4.22
Fixed in WordPress 4.4.25
4.4.21
Fixed in WordPress 4.4.25
4.4.20
Fixed in WordPress 4.4.25
4.4.19
Fixed in WordPress 4.4.25
4.4.18
Fixed in WordPress 4.4.25
4.4.17
Fixed in WordPress 4.4.25
4.4.16
Fixed in WordPress 4.4.25
4.4.15
Fixed in WordPress 4.4.25
4.4.14
Fixed in WordPress 4.4.25
4.4.13
Fixed in WordPress 4.4.25
4.4.12
Fixed in WordPress 4.4.25
4.4.11
Fixed in WordPress 4.4.25
4.4.10
Fixed in WordPress 4.4.25
4.4.9
Fixed in WordPress 4.4.25
4.4.8
Fixed in WordPress 4.4.25
4.4.7
Fixed in WordPress 4.4.25
4.4.6
Fixed in WordPress 4.4.25
4.4.5
Fixed in WordPress 4.4.25
4.4.4
Fixed in WordPress 4.4.25
4.4.3
Fixed in WordPress 4.4.25
4.4.2
Fixed in WordPress 4.4.25
4.4.1
Fixed in WordPress 4.4.25
4.4
Fixed in WordPress 4.4.25
4.3.25
Fixed in WordPress 4.3.26
4.3.24
Fixed in WordPress 4.3.26
4.3.23
Fixed in WordPress 4.3.26
4.3.22
Fixed in WordPress 4.3.26
4.3.21
Fixed in WordPress 4.3.26
4.3.20
Fixed in WordPress 4.3.26
4.3.19
Fixed in WordPress 4.3.26
4.3.18
Fixed in WordPress 4.3.26
4.3.17
Fixed in WordPress 4.3.26
4.3.16
Fixed in WordPress 4.3.26
4.3.15
Fixed in WordPress 4.3.26
4.3.14
Fixed in WordPress 4.3.26
4.3.13
Fixed in WordPress 4.3.26
4.3.12
Fixed in WordPress 4.3.26
4.3.11
Fixed in WordPress 4.3.26
4.3.10
Fixed in WordPress 4.3.26
4.3.9
Fixed in WordPress 4.3.26
4.3.8
Fixed in WordPress 4.3.26
4.3.7
Fixed in WordPress 4.3.26
4.3.6
Fixed in WordPress 4.3.26
4.3.5
Fixed in WordPress 4.3.26
4.3.4
Fixed in WordPress 4.3.26
4.3.3
Fixed in WordPress 4.3.26
4.3.2
Fixed in WordPress 4.3.26
4.3.1
Fixed in WordPress 4.3.26
4.3
Fixed in WordPress 4.3.26
4.2.29
Fixed in WordPress 4.2.30
4.2.28
Fixed in WordPress 4.2.30
4.2.27
Fixed in WordPress 4.2.30
4.2.26
Fixed in WordPress 4.2.30
4.2.25
Fixed in WordPress 4.2.30
4.2.24
Fixed in WordPress 4.2.30
4.2.23
Fixed in WordPress 4.2.30
4.2.22
Fixed in WordPress 4.2.30
4.2.21
Fixed in WordPress 4.2.30
4.2.20
Fixed in WordPress 4.2.30
4.2.19
Fixed in WordPress 4.2.30
4.2.18
Fixed in WordPress 4.2.30
4.2.17
Fixed in WordPress 4.2.30
4.2.16
Fixed in WordPress 4.2.30
4.2.15
Fixed in WordPress 4.2.30
4.2.14
Fixed in WordPress 4.2.30
4.2.13
Fixed in WordPress 4.2.30
4.2.12
Fixed in WordPress 4.2.30
4.2.11
Fixed in WordPress 4.2.30
4.2.10
Fixed in WordPress 4.2.30
4.2.9
Fixed in WordPress 4.2.30
4.2.8
Fixed in WordPress 4.2.30
4.2.7
Fixed in WordPress 4.2.30
4.2.6
Fixed in WordPress 4.2.30
4.2.5
Fixed in WordPress 4.2.30
4.2.4
Fixed in WordPress 4.2.30
4.2.3
Fixed in WordPress 4.2.30
4.2.2
Fixed in WordPress 4.2.30
4.2.1
Fixed in WordPress 4.2.30
4.2
Fixed in WordPress 4.2.30
4.1.32
Fixed in WordPress 4.1.33
4.1.31
Fixed in WordPress 4.1.33
4.1.30
Fixed in WordPress 4.1.33
4.1.29
Fixed in WordPress 4.1.33
4.1.28
Fixed in WordPress 4.1.33
4.1.27
Fixed in WordPress 4.1.33
4.1.26
Fixed in WordPress 4.1.33
4.1.25
Fixed in WordPress 4.1.33
4.1.24
Fixed in WordPress 4.1.33
4.1.23
Fixed in WordPress 4.1.33
4.1.22
Fixed in WordPress 4.1.33
4.1.21
Fixed in WordPress 4.1.33
4.1.20
Fixed in WordPress 4.1.33
4.1.19
Fixed in WordPress 4.1.33
4.1.18
Fixed in WordPress 4.1.33
4.1.17
Fixed in WordPress 4.1.33
4.1.16
Fixed in WordPress 4.1.33
4.1.15
Fixed in WordPress 4.1.33
4.1.14
Fixed in WordPress 4.1.33
4.1.13
Fixed in WordPress 4.1.33
4.1.12
Fixed in WordPress 4.1.33
4.1.11
Fixed in WordPress 4.1.33
4.1.10
Fixed in WordPress 4.1.33
4.1.9
Fixed in WordPress 4.1.33
4.1.8
Fixed in WordPress 4.1.33
4.1.7
Fixed in WordPress 4.1.33
4.1.6
Fixed in WordPress 4.1.33
4.1.5
Fixed in WordPress 4.1.33
4.1.4
Fixed in WordPress 4.1.33
4.1.3
Fixed in WordPress 4.1.33
4.1.2
Fixed in WordPress 4.1.33
4.1.1
Fixed in WordPress 4.1.33
4.1
Fixed in WordPress 4.1.33
4.0.32
Fixed in WordPress 4.0.33
4.0.31
Fixed in WordPress 4.0.33
4.0.30
Fixed in WordPress 4.0.33
4.0.29
Fixed in WordPress 4.0.33
4.0.28
Fixed in WordPress 4.0.33
4.0.27
Fixed in WordPress 4.0.33
4.0.26
Fixed in WordPress 4.0.33
4.0.25
Fixed in WordPress 4.0.33
4.0.24
Fixed in WordPress 4.0.33
4.0.23
Fixed in WordPress 4.0.33
4.0.22
Fixed in WordPress 4.0.33
4.0.21
Fixed in WordPress 4.0.33
4.0.20
Fixed in WordPress 4.0.33
4.0.19
Fixed in WordPress 4.0.33
4.0.18
Fixed in WordPress 4.0.33
4.0.17
Fixed in WordPress 4.0.33
4.0.16
Fixed in WordPress 4.0.33
4.0.15
Fixed in WordPress 4.0.33
4.0.14
Fixed in WordPress 4.0.33
4.0.13
Fixed in WordPress 4.0.33
4.0.12
Fixed in WordPress 4.0.33
4.0.11
Fixed in WordPress 4.0.33
4.0.10
Fixed in WordPress 4.0.33
4.0.9
Fixed in WordPress 4.0.33
4.0.8
Fixed in WordPress 4.0.33
4.0.7
Fixed in WordPress 4.0.33
4.0.6
Fixed in WordPress 4.0.33
4.0.5
Fixed in WordPress 4.0.33
4.0.4
Fixed in WordPress 4.0.33
4.0.3
Fixed in WordPress 4.0.33
4.0.2
Fixed in WordPress 4.0.33
4.0.1
Fixed in WordPress 4.0.33
4.0
Fixed in WordPress 4.0.33
3.9.33
Fixed in WordPress 3.9.34
3.9.32
Fixed in WordPress 3.9.34
3.9.31
Fixed in WordPress 3.9.34
3.9.30
Fixed in WordPress 3.9.34
3.9.29
Fixed in WordPress 3.9.34
3.9.28
Fixed in WordPress 3.9.34
3.9.27
Fixed in WordPress 3.9.34
3.9.26
Fixed in WordPress 3.9.34
3.9.25
Fixed in WordPress 3.9.34
3.9.24
Fixed in WordPress 3.9.34
3.9.23
Fixed in WordPress 3.9.34
3.9.22
Fixed in WordPress 3.9.34
3.9.21
Fixed in WordPress 3.9.34
3.9.20
Fixed in WordPress 3.9.34
3.9.19
Fixed in WordPress 3.9.34
3.9.18
Fixed in WordPress 3.9.34
3.9.17
Fixed in WordPress 3.9.34
3.9.16
Fixed in WordPress 3.9.34
3.9.15
Fixed in WordPress 3.9.34
3.9.14
Fixed in WordPress 3.9.34
3.9.13
Fixed in WordPress 3.9.34
3.9.12
Fixed in WordPress 3.9.34
3.9.11
Fixed in WordPress 3.9.34
3.9.10
Fixed in WordPress 3.9.34
3.9.9
Fixed in WordPress 3.9.34
3.9.8
Fixed in WordPress 3.9.34
3.9.7
Fixed in WordPress 3.9.34
3.9.6
Fixed in WordPress 3.9.34
3.9.5
Fixed in WordPress 3.9.34
3.9.4
Fixed in WordPress 3.9.34
3.9.3
Fixed in WordPress 3.9.34
3.9.2
Fixed in WordPress 3.9.34
3.9.1
Fixed in WordPress 3.9.34
3.9
Fixed in WordPress 3.9.34
3.8.35
Fixed in WordPress 3.8.36
3.8.34
Fixed in WordPress 3.8.36
3.8.33
Fixed in WordPress 3.8.36
3.8.32
Fixed in WordPress 3.8.36
3.8.31
Fixed in WordPress 3.8.36
3.8.30
Fixed in WordPress 3.8.36
3.8.29
Fixed in WordPress 3.8.36
3.8.28
Fixed in WordPress 3.8.36
3.8.27
Fixed in WordPress 3.8.36
3.8.26
Fixed in WordPress 3.8.36
3.8.25
Fixed in WordPress 3.8.36
3.8.24
Fixed in WordPress 3.8.36
3.8.23
Fixed in WordPress 3.8.36
3.8.22
Fixed in WordPress 3.8.36
3.8.21
Fixed in WordPress 3.8.36
3.8.20
Fixed in WordPress 3.8.36
3.8.19
Fixed in WordPress 3.8.36
3.8.18
Fixed in WordPress 3.8.36
3.8.17
Fixed in WordPress 3.8.36
3.8.16
Fixed in WordPress 3.8.36
3.8.15
Fixed in WordPress 3.8.36
3.8.14
Fixed in WordPress 3.8.36
3.8.13
Fixed in WordPress 3.8.36
3.8.12
Fixed in WordPress 3.8.36
3.8.11
Fixed in WordPress 3.8.36
3.8.10
Fixed in WordPress 3.8.36
3.8.9
Fixed in WordPress 3.8.36
3.8.8
Fixed in WordPress 3.8.36
3.8.7
Fixed in WordPress 3.8.36
3.8.6
Fixed in WordPress 3.8.36
3.8.5
Fixed in WordPress 3.8.36
3.8.4
Fixed in WordPress 3.8.36
3.8.3
Fixed in WordPress 3.8.36
3.8.2
Fixed in WordPress 3.8.36
3.8.1
Fixed in WordPress 3.8.36
3.8
Fixed in WordPress 3.8.36
3.7.35
Fixed in WordPress 3.7.36
3.7.34
Fixed in WordPress 3.7.36
3.7.33
Fixed in WordPress 3.7.36
3.7.32
Fixed in WordPress 3.7.36
3.7.31
Fixed in WordPress 3.7.36
3.7.30
Fixed in WordPress 3.7.36
3.7.29
Fixed in WordPress 3.7.36
3.7.28
Fixed in WordPress 3.7.36
3.7.27
Fixed in WordPress 3.7.36
3.7.26
Fixed in WordPress 3.7.36
3.7.25
Fixed in WordPress 3.7.36
3.7.24
Fixed in WordPress 3.7.36
3.7.23
Fixed in WordPress 3.7.36
3.7.22
Fixed in WordPress 3.7.36
3.7.21
Fixed in WordPress 3.7.36
3.7.20
Fixed in WordPress 3.7.36
3.7.19
Fixed in WordPress 3.7.36
3.7.18
Fixed in WordPress 3.7.36
3.7.17
Fixed in WordPress 3.7.36
3.7.16
Fixed in WordPress 3.7.36
3.7.15
Fixed in WordPress 3.7.36
3.7.14
Fixed in WordPress 3.7.36
3.7.13
Fixed in WordPress 3.7.36
3.7.12
Fixed in WordPress 3.7.36
3.7.11
Fixed in WordPress 3.7.36
3.7.10
Fixed in WordPress 3.7.36
3.7.9
Fixed in WordPress 3.7.36
3.7.8
Fixed in WordPress 3.7.36
3.7.7
Fixed in WordPress 3.7.36
3.7.6
Fixed in WordPress 3.7.36
3.7.5
Fixed in WordPress 3.7.36
3.7.4
Fixed in WordPress 3.7.36
3.7.3
Fixed in WordPress 3.7.36
3.7.2
Fixed in WordPress 3.7.36
3.7.1
Fixed in WordPress 3.7.36
3.7
Fixed in WordPress 3.7.36

References

CVE
CVE-2020-36326
CVE
CVE-2018-19296
URL
https://github.com/WordPress/WordPress/commit/267061c9595fedd321582d14c21ec9e7da2dcf62
URL
https://wordpress.org/news/2021/05/wordpress-5-7-2-security-release/
URL
https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9
URL
https://www.wordfence.com/blog/2021/05/wordpress-5-7-2-security-release-what-you-need-to-know/
YouTube Video

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
6.6 (medium)

Miscellaneous

Original Researcher
WordPress Security Team
Verified
Yes
WPVDB ID
4cd46653-4470-40ff-8aac-318bee2f998d

Timeline

Publicly Published
2021-05-13 (about 3 years ago)
Added
2021-05-13 (about 3 years ago)
Last Updated
2021-05-15 (about 3 years ago)

Other

Published
Title
Published
2017-04-06
Title
blogVault 1.40-1.44 - Unauthenticated PHP Object Injection
Published
2024-04-09
Title
Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce < 2.6.4 - Authenticated (Admin+) PHP Object Injection
Published
2024-05-03
Title
ConvertPlug < 3.5.26 - Authenticated (Contributor+) PHP Object Injection
Published
2016-12-09
Title
BP Profile Search < 4.6 - PHP Object Injection
Published
2024-04-25
Title
Custom field finder < 0.4 - Authenticated (Author+) PHP Object Injection