CVE-2021-29447
high-risk
Published 2021-04-15
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.
Do I need to act?
!
90.0% chance of exploitation in next 30 days
EPSS score — higher than 10% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.1/10
High
NETWORK
/ LOW complexity
Affected Products (3)
References (14)
Third Party Advisory
http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upl...
Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc5...
Release Notes
https://wordpress.org/news/category/security/
Third Party Advisory
https://www.debian.org/security/2021/dsa-4896
Third Party Advisory
http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upl...
Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc5...
Release Notes
https://wordpress.org/news/category/security/
Third Party Advisory
https://www.debian.org/security/2021/dsa-4896
54
/ 100
high-risk
Severity
25/34 · High
Exploitability
20/34 · Moderate
Exposure
9/34 · Low