Log in Start free

Vulnerability · Published Apr 15, 2021 · Assigned by GitHub_M

CVE-2021-29447WordPress Authenticated XXE attack when installation is running PHP 8

High 7.1

In plain English

A high-severity XML external entity in wordpress-develop from WordPress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 85.7% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)85.7%top 0.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wordpress5.7.1+dfsg1-1DEBIAN-CVE-2021-29447
Debian:13wordpress5.7.1+dfsg1-1DEBIAN-CVE-2021-29447
Debian:14wordpress5.7.1+dfsg1-1DEBIAN-CVE-2021-29447
Ubuntu:22.04:LTSwordpressno fix listedUBUNTU-CVE-2021-29447
Ubuntu:24.04:LTSwordpressno fix listedUBUNTU-CVE-2021-29447
Ubuntu:25.10wordpressno fix listedUBUNTU-CVE-2021-29447
Ubuntu:26.04:LTSwordpressno fix listedUBUNTU-CVE-2021-29447
Ubuntu:26.10wordpressno fix listedUBUNTU-CVE-2021-29447

Affected products (as reported)

VendorProductVersions
WordPress wordpress-develop >= 5.6.0, < 5.7.1

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References