CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.

• phpmailer project phpmailer (>= 6.1.8 <= 6.4.0) • wordpress wordpress (>= 3.7 < 3.7.36) • wordpress wordpress (>= 3.8 < 3.8.36) • wordpress wordpress (>= 3.9 < 3.9.34) • wordpress wordpress (>= 4.0 < 4.0.33) • wordpress wordpress (>= 4.1 < 4.1.33) • wordpress wordpress (>= 4.2 < 4.2.30) • wordpress wordpress (>= 4.3 < 4.3.26) • wordpress wordpress (>= 4.4 < 4.4.25) • wordpress wordpress (>= 4.5 < 4.5.24) • wordpress wordpress (>= 4.6 < 4.6.21) • wordpress wordpress (>= 4.7 < 4.7.21) • wordpress wordpress (>= 4.8 < 4.8.17) • wordpress wordpress (>= 4.9 < 4.9.18) • wordpress wordpress (>= 5.0 < 5.0.13) • wordpress wordpress (>= 5.1 < 5.1.10) • wordpress wordpress (>= 5.2 < 5.2.11) • wordpress wordpress (>= 5.3 < 5.3.8) • wordpress wordpress (>= 5.4 < 5.4.6) • wordpress wordpress (>= 5.5 < 5.5.5) • wordpress wordpress (>= 5.6 < 5.6.4) • wordpress wordpress (>= 5.7 < 5.7.2)