WP Core Vulnerability MAY 2021:
WordPress 3.7 to 5.7.1 – Object Injection in PHPMailer
For your WordPress protection, be informed about the LATEST WP Core Vulnerability MAY 2021. Publicly known since its first official report on 2022-05-13 or it’s official disclosure on 2022-05-15. All versions of WordPress starting with 3.7 to 5.7.1 have the Object Injection in PHPMailer vulnerability.
WordPress 3.7 to 5.7.1 – Object Injection in PHPMailer
References: CVE-2020-36326 + CVE-2018-19296
- WordPress 3.7 to 5.7.1 CORE Object Injection in PHPMailer
- This security release features one security fix. Because this is a security release (WordPress 5.7.2 Security Release), it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated. Active installations: 41.7% of the ENTIRE INTERNET minus the updated instances of 5.7.2, since released on May 13, 2022.
Impact – What can an attacker do:
WordPress versions 3.7 to 5.7.1 were using a vulnerable version of the PHPMailer library, which was affected by a PHP Object Injection vulnerability through Phar Deserialization via addAttachment with a UNC pathname.
To fix the vulnerability the PHPMailer library was updated from version 6.4.0 to 6.4.1.
The PHPMailer library developers state that, “PHPMailer versions between 6.1.8 and 6.4.0 contain a regression of the earlier CVE-2018-19296 object injection vulnerability as a result of a fix for Windows UNC paths in 6.1.8. Recorded as CVE-2020-36326. Reported by Fariskhi Vidyan via Tidelift. 6.4.1 fixes this issue, and also enforces stricter checks for URL schemes in local path contexts.”
To ensure that your WordPress website is secure against this vulnerability, update to version 5.7.2, or another patched minor version.
