CVE-2021-29447highCWE-611

CVE-2021-29447: high-severity vulnerability in wordpress-develop

WordPress Authenticated XXE attack when installation is running PHP 8

Published · Updated

Follow this CVE+ Monitor wordpress-develop+ Monitor wordpress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

65Vexday Risk Score

Keep watching. It has a public proof of concept.

ssvc Attendcvss 7.1epss 86%
from disclosure to weapon1 day
Published on NVDApr 15
1st PoC+1d
In short

WordPress users with file upload permissions (like Authors) can exploit an XML parsing flaw in the Media Library to read internal server files, but only if the site runs PHP 8. This vulnerability has been patched in WordPress 5.7.1 and older versions.

Technical detail

An authenticated XXE (XML External Entity) vulnerability exists in WordPress Media Library when running on PHP 8, allowing users with upload capabilities to parse malicious XML files and access sensitive internal files through entity expansion. The attack requires file upload permissions and PHP 8 environment; patched in WordPress 5.7.1+.

Summary generated and translated by AI from the official description.
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected products
WordPress · wordpress-develop
public PoCs found — 27
exploitdbwww.exploit-db.com/exploits/50304unverifiedgithubgithub.com/motikan2010/CVE-2021-29447★ 44githubgithub.com/mega8bit/exploit_cve-2021-29447★ 7githubgithub.com/0xRar/CVE-2021-29447-PoC★ 6githubgithub.com/M3l0nPan/wordpress-cve-2021-29447★ 4githubgithub.com/Vulnmachines/wordpress_cve-2021-29447★ 4githubgithub.com/elf1337/blind-xxe-controller-CVE-2021-29447★ 3githubgithub.com/thomas-osgood/CVE-2021-29447★ 3githubgithub.com/dnr6419/CVE-2021-29447★ 3githubgithub.com/Tea-On/CVE-2021-29447-Authenticated-XXE-WordPress-5.6-5.7★ 2githubgithub.com/Abdulazizalsewedy/CVE-2021-29447★ 2githubgithub.com/Val-Resh/CVE-2021-29447-POC★ 1githubgithub.com/b-abderrahmane/CVE-2021-29447-POC★ 1githubgithub.com/ArtemCyberLab/Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-★ 1githubgithub.com/AssassinUKG/CVE-2021-29447★ 0githubgithub.com/G01d3nW01f/CVE-2021-29447★ 0githubgithub.com/viardant/CVE-2021-29447★ 0githubgithub.com/Kashyapghodasara/Public_Exploit-1--Wordpress-CVE-2021-29447★ 0githubgithub.com/rdana55/CVE-2021-29447-PoC★ 0githubgithub.com/andyhsu024/CVE-2021-29447★ 0githubgithub.com/magicrc/CVE-2021-29447★ 0githubgithub.com/davids52/cve-2021-29447_auto-script★ 0githubgithub.com/specializzazione-cyber-security/demo-CVE-2021-29447-lezione★ 0githubgithub.com/0xricksanchez/CVE-2021-29447★ 0githubgithub.com/danilo1992-sys/CVE-2021-29447★ 0cve_referencepacketstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.htmlunverifiedcve_referencepacketstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — wordpress-develop

In the same product, most dangerous first.

CVE-2022-21661HIGHSQL injection in WordPressEPSS 97.8%CVE-2022-21662HIGHStored XSS in WordPressEPSS 64.5%CVE-2022-21663MEDIUMAuthenticated Object Injection in Multisites in WordPressEPSS 3.8%CVE-2022-21664HIGHSQL injection in WordPressEPSS 3.7%CVE-2020-4047MEDIUMAuthenticated XSS via media attachment page in WordPressEPSS 3.3%CVE-2024-31211MEDIUMRemote Code Execution in `WP_HTML_Token`EPSS 2.7%