{"id":"CVE-2018-20149","aliases":["DEBIAN-CVE-2018-20149","DLA-1673-1","DSA-4401-1","EUVD-2018-12718","GHSA-33wf-jvrq-cxjv","UBUNTU-CVE-2018-20149"],"status":"published","title":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors...","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02893,"percentile":0.87001,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-12-14T20:00:00Z","modified":"2026-10-24T10:49:39Z","fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["5.0.1+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["5.0.1+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["5.0.1+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.25+dfsg-1+deb8u1"}]}],"versions":["4.1+dfsg-1","4.1+dfsg-1+deb8u1","4.1+dfsg-1+deb8u10","4.1+dfsg-1+deb8u11","4.1+dfsg-1+deb8u12","4.1+dfsg-1+deb8u13","4.1+dfsg-1+deb8u14","4.1+dfsg-1+deb8u15","4.1+dfsg-1+deb8u16","4.1+dfsg-1+deb8u17","4.1+dfsg-1+deb8u18","4.1+dfsg-1+deb8u2","4.1+dfsg-1+deb8u3","4.1+dfsg-1+deb8u4","4.1+dfsg-1+deb8u5","4.1+dfsg-1+deb8u6","4.1+dfsg-1+deb8u7","4.1+dfsg-1+deb8u8","4.1+dfsg-1+deb8u9","4.1.1+dfsg-1"],"bundled":7},{"source":"osv","ecosystem":"Debian:9","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.5+dfsg-2+deb9u5"}]}],"versions":["4.7.5+dfsg-2","4.7.5+dfsg-2+deb9u1","4.7.5+dfsg-2+deb9u1~bpo8+1","4.7.5+dfsg-2+deb9u2","4.7.5+dfsg-2+deb9u2~bpo8+1","4.7.5+dfsg-2+deb9u3","4.7.5+dfsg-2+deb9u4"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"http://www.securityfocus.com/bid/106220","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://wordpress.org/support/wordpress-version/version-5-0-1/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://codex.wordpress.org/Version_4.9.9","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","advisory"]},{"url":"https://wpvulndb.com/vulnerabilities/9175","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://www.debian.org/security/2019/dsa-4401","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/","tags":["x_refsource_MISC","x_transferred","Press/Media Coverage","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20149"},{"url":"https://github.com/advisories/GHSA-33wf-jvrq-cxjv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-20149","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-20149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20149","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-20149","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","status":"published","published":"2018-12-14T20:00:00Z","modified":"2024-08-05T11:51:19.304Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2018-12718","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","status":"published","published":"2018-12-14T20:00:00Z","modified":"2024-08-05T11:51:19Z","updated_at":"2026-11-03T02:39:31.423203Z"}],"ghsa":[{"id":"GHSA-33wf-jvrq-cxjv","title":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors...","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","status":"published","published":"2022-05-14T01:29:39Z","modified":"2023-02-02T05:04:08Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:51:47.947252Z"}],"nvd":[{"id":"CVE-2018-20149","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","status":"published","published":"2018-12-14T20:29:00.437Z","modified":"2026-06-17T01:52:20.88Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-20149","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","status":"published","published":"2018-12-14T20:29:00.437Z","modified":"2026-10-24T10:49:39.266722397Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-20149","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","status":"published","published":"2018-12-14T20:29:00.437Z","modified":"2026-10-23T18:03:20.998754351Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-20149","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","status":"published","published":"2018-12-14T20:29:00Z","modified":"2025-10-24T04:47:17Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"DLA-1673-1","title":"wordpress - security update","status":"published","published":"2019-02-11T00:00:00Z","modified":"2026-03-09T01:23:37.293032Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4401-1","title":"wordpress - security update","status":"published","published":"2019-03-01T00:00:00Z","modified":"2026-03-09T02:10:14.434121Z","updated_at":"2026-11-02T15:46:16.862196Z"}]}}