WordPress Core < 5.5.2 - Deserialization Gadget

Reaching this weakness in WordPress 5.5 3.7 – 5.5.1 · 20 branches takes a caller who can reach the endpoint. Deserialization of untrusted data means the application reconstructs objects from input a caller controls, letting the attacker choose which classes get instantiated and what their properties hold.

A workable chain turns deserialization into file writes, deletions or code execution, depending on what the loaded classes do in their magic methods. For WordPress 5.5 the fix is 3.7.35: builds 3.7 – 5.5.1 · 20 branches are affected, anything from 3.7.35 onward is not.