Detections
Analytics
WordPress 5.4.x < 5.4.6 Object injection
critical Web App Scanning Plugin ID 112790
Language:
Synopsis
WordPress 5.4.x < 5.4.6 Object injectionDescription
According to its self-reported version number, the detected WordPress application is affected by an object injection vulnerability in PHPMailer.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update to WordPress version 5.4.6 or latest.See Also
https://wordpress.org/news/2021/05/wordpress-5-7-2-security-release/
https://wordpress.org/support/wordpress-version/version-5-4-6/
Plugin Details
Severity: Critical
ID: 112790
Type: remote
Family: Component Vulnerability
Published: 5/17/2021
Updated: 3/14/2023
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-36326
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2020-36326
Vulnerability Information
CPE: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Patch Publication Date: 5/13/2021
Vulnerability Publication Date: 11/15/2018
Reference Information
CVE: CVE-2018-19296, CVE-2020-36326
OWASP: 2010-A1, 2010-A4, 2013-A1, 2013-A4, 2013-A9, 2017-A1, 2017-A8, 2017-A9, 2021-A6, 2021-A8
WASC: Improper Input Handling
DISA STIG: APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(e)
ISO: 27001-A.13.1.3, 27001-A.13.2.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5
NIST: sp800_53-AC-4, sp800_53-CM-6b, sp800_53-SI-10(5)
OWASP API: 2019-API7, 2019-API8, 2023-API3, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.1.2, 4.0.2-5.3.1, 4.0.2-5.5.1