CVE-2018-20148

CRITICAL

WordPress <4.9.9, 5.x <5.0.1 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-20148. PoCs published by nth347.

AI-analyzed exploit summary This exploit leverages PHAR deserialization in WordPress via XML-RPC to achieve remote code execution (RCE). It uploads a malicious polyglot file, manipulates metadata to trigger deserialization, and executes arbitrary commands.

Description

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

Exploits (1)

nomisec WORKING POC 4 stars
by nth347 · poc
https://github.com/nth347/CVE-2018-20148_exploit

This exploit leverages PHAR deserialization in WordPress via XML-RPC to achieve remote code execution (RCE). It uploads a malicious polyglot file, manipulates metadata to trigger deserialization, and executes arbitrary commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress (with WooCommerce)
Auth required
Prerequisites: Valid WordPress admin credentials · XML-RPC enabled · PHPGGC for payload generation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/106220
Release Notes, Vendor Advisory x_refsource_misc
https://wordpress.org/support/wordpress-version/version-5-0-1/
Product, Vendor Advisory x_refsource_misc
https://codex.wordpress.org/Version_4.9.9
Vendor Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9171
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4401
Release Notes, Vendor Advisory x_refsource_misc
https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html

Scores

CVSS v3 9.8
EPSS 0.3089
EPSS Percentile 98.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (3)
debian/debian_linux 8.0
debian/debian_linux 9.0
wordpress/wordpress < 4.9.9
Published Dec 14, 2018
Tracked Since Feb 18, 2026