WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer

WordPress versions 3.7 to 5.7.1 were using a vulnerable version of the PHPMailer library, which was affected by a PHP Object Injection vulnerability through Phar Deserialization via addAttachment with a UNC pathname. To fix the vulnerability the PHPMailer library was updated from version 6.4.0 to 6.4.1. The PHPMailer library developers state that, “PHPMailer versions between 6.1.8 and 6.4.0 contain a regression of the earlier CVE-2018-19296 object injection vulnerability as a result of a fix for Windows UNC paths in 6.1.8. Recorded as CVE-2020-36326. Reported by Fariskhi Vidyan via Tidelift. 6.4.1 fixes this issue, and also enforces stricter checks for URL schemes in local path contexts.” To ensure that your WordPress website is secure against this vulnerability, update to version 5.7.2, or another patched minor version listed below.