To plugin page

Fixed

WordPress <= 5.7.1 - Object injection in PHPMailer vulnerability

9.8

CVSS 3.1 score Critical severity

Report

Monitoring Not reported to be exploited

Find out about vulnerable plugins in your websites for free.

Scan your website

Software

WordPress

Type

WordPress Core

Vulnerable versions

<= 5.7.1

Fixed in

5.7.2

PSID

b5427063aa90

CVE ID

CVE-2020-36326, 2018-19296

Classification

PHP Object Injection

OWASP Top 10

A9: Using Components with Known Vulnerabilities

Required privilege

Credits

WordPress Security Team

Publicly disclosed

2021-05-13

Details

Object injection in PHPMailer vulnerability discovered in WordPress (one security issue affecting WordPress versions between 3.7 and 5.7).

Solution

Update the WordPress to the latest available version (at least 5.7.2). All WordPress versions since 3.7 have also been updated to fix the following security issue.

References

Vulnerability details #2 Vulnerability details #1 CVE #2 CVE #1 Release information

Other known vulnerabilities for WordPress

Authenticated CrossSite Scripting (XSS) vulnerability

<= 6.0.1

4.9

31.08.2022

Authenticated Stored CrossSite Scripting (XSS) vulnerability

<= 6.0.1

4.9

31.08.2022

Authenticated SQL Injection (SQLi) vulnerability via Link API

<= 6.0.1

7.7

31.08.2022

Stored CrossSite Scripting (XSS) vulnerability

<= 5.9.1

5.4

11.03.2022

SQL Injection (SQLi) vulnerability

<= 5.8.2

06.01.2022

SQL Injection (SQLi) vulnerability

<= 5.8.2

7.4

06.01.2022

Submit vulnerabilities and become a verified Alliance member

Learn more

WordPress <= 5.7.1 - Object injection in PHPMailer vulnerability

Details

Solution

References

Other known vulnerabilities for WordPress

Submit vulnerabilities and become a verified Alliance member

All solutions

WordPress security

Patchstack

Social

All solutions

WordPress Security

Patchstack

Social

© 2022 Patchstack

WordPress <= 5.7.1 - Object injection in PHPMailer vulnerability

Details

Solution

References

Other known vulnerabilities for WordPress

Submit vulnerabilities and become a verified Alliance member

All solutions

WordPress security

Patchstack

Social

All solutions

WordPress Security

Patchstack

Social

© 2022 Patchstack

Let us know if we have missed a vulnerability reported elsewhere

Thank you for contributing!