Vulnerability Intelligence Report
CVE-2020-36326
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:3.09%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| phpmailer_project | phpmailer | all |
| wordpress | wordpress | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
3.095%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2021-04-28T00:00:00 |
| Published | 2021-04-28T02:21:53 |
| Last Updated | 2024-08-04T17:23:10 |
Community Chatter & Buzz