Vulnerability · Published May 16, 2026 · Assigned by VulnCheck
CVE-2021-47976TextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload
High 8.8
In plain English
A high-severity cross-site request forgery in TextPattern CMS from Textpattern. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 75.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Textpattern | TextPattern CMS | 4.9.0-dev |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50095 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: TextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload third-party-advisory