CVE-2020-28032
📋 TL;DR
CVE-2020-28032 is a critical deserialization vulnerability in WordPress that allows remote code execution. It affects WordPress sites before version 5.5.2 by exploiting improper handling of serialized data in the FilteredIterator utility. Any WordPress site running vulnerable versions is at risk of complete compromise.
💻 Affected Systems
- WordPress
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Wordpress by Wordpress
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of the WordPress server, executes arbitrary code, installs malware, steals data, and pivots to other systems.
Likely Case
Attackers exploit the vulnerability to install backdoors, deface websites, steal sensitive data, or use the server for cryptocurrency mining or DDoS attacks.
If Mitigated
With proper network segmentation and minimal privileges, impact is limited to the WordPress application layer, preventing lateral movement to other systems.
🎯 Exploit Status
Exploits are publicly available and require no authentication, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WordPress 5.5.2 and later
Vendor Advisory: https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
Restart Required: No
Instructions:
1. Backup your WordPress site and database. 2. Update WordPress to version 5.5.2 or later via the admin dashboard (Dashboard → Updates). 3. Verify the update completed successfully. 4. Clear any caching plugins or CDN caches.
🔧 Temporary Workarounds
Disable XML-RPC
allTemporarily disable XML-RPC functionality which may be used in exploitation chains
Add to wp-config.php: add_filter('xmlrpc_enabled', '__return_false');
Web Application Firewall Rule
allBlock requests containing serialized PHP object patterns
WAF specific - create rule to block requests with patterns like O:[0-9]+:"\w+":
ModSecurity rule: SecRule ARGS "@rx O:[0-9]+:\"\\w+\":" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WordPress from critical systems
- Deploy a web application firewall with rules to detect and block deserialization attacks
🔍 How to Verify
Check if Vulnerable:
Check WordPress version in admin dashboard (Dashboard → Updates) or examine wp-includes/version.php file for version numberCheck Version:
grep '\$wp_version' wp-includes/version.phpVerify Fix Applied:
Confirm WordPress version is 5.5.2 or higher and check that the FilteredIterator.php file contains the security patch from the GitHub commit📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to XML-RPC endpoints
- Requests containing serialized object patterns (O:8:"stdClass":)
- Sudden appearance of new admin users or plugins
- Unexpected file writes in wp-content/uploads
Network Indicators:
- HTTP requests with unusual Content-Type headers
- Multiple rapid requests to wp-admin or xmlrpc.php
- Outbound connections to suspicious IPs from WordPress server
SIEM Query:
source="wordpress.log" AND ("xmlrpc.php" OR "serialize" OR "O:" OR "unserialize")🔗 References
- https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3
- https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
- https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
- https://wpscan.com/vulnerability/10446
- https://www.debian.org/security/2020/dsa-4784
- https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3
- https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
- https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
- https://wpscan.com/vulnerability/10446
- https://www.debian.org/security/2020/dsa-4784
