{"id":"CVE-2018-20149","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-20149","generatedAt":"2026-10-28T19:02:45.210Z","title":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","description":"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.","published":"2018-12-14T20:29:00.000Z","lastModified":"2026-06-17T01:52:21.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["wordpress/wordpress","debian/debian linux"],"epss":{"score":0.02893,"percentile":0.86836,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.04201,"percentile":0.90536},{"date":"2026-09-22","score":0.02893,"percentile":0.8631}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.89%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/106220","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://codex.wordpress.org/Version_4.9.9","tags":["Product","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/","tags":["Release Notes","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://wordpress.org/support/wordpress-version/version-5-0-1/","tags":["Release Notes","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://wpvulndb.com/vulnerabilities/9175","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2019/dsa-4401","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/","tags":["Press/Media Coverage","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/106220","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://codex.wordpress.org/Version_4.9.9","tags":["Product","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wordpress.org/support/wordpress-version/version-5-0-1/","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wpvulndb.com/vulnerabilities/9175","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4401","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/","tags":["Press/Media Coverage","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-20149","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}