$ cve CVE-2021-29447 JSON

CVE-2021-29447 EXPLOIT

7.1

HIGH · CVSS 3.1 · EPSS 85.7% (pctl 100)

Patch early

A public exploit exists.

Description

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.

Scoring

CVSS	7.1 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS	85.72% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-611
On CISA KEV	no
Public exploit	yes
Published	2021-04-15
Last modified	2026-06-17

Affected (2)

Vendor	Product
debian	debian linux
wordpress	wordpress

Public exploits

Source	Title	Date
exploit-db	WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)	2021-09-20

References

→ the Explorer · watch your stack · NVD