Critical severity · published Apr 28, 2021
CVE-2020-36326
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname
9.8
CVSS
3.1%
EPSS
No
On KEV
Description
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WordPress · WordPress
3.7 before 3.7.36; 3.8 before 3.8.36; 3.9 before 3.9.34; 4.0 before 4.0.33; 4.1 before 4.1.33; 4.2 before 4.2.30; +15 more · source: NVD
PH
Phpmailer · Phpmailer Project
6.1.8 through 6.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36326
Patch
https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT/
More from WordPress
9.8
CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
9.8
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
8.1
CVE-2026-87902
WordPress Core Remote File Inclusion Vulnerability
7.5
CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability