CVE-2021-29447 in the critical feed json
WordPress Authenticated XXE attack when installation is running PHP 8
published 2021-04-15 5 y ago modified 2026-09-10 59 d ago also BIT-wordpress-2021-29447 , BIT-wordpress-multisite-2021-29447 , EUVD-2021-16064 , GHSA-rv47-pc52-qrhh
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 85.7%
- EPSS 85.7% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 1
- Exploit-DB
Summary
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.
Patch / fix
- bitnami wordpress 5.7.1
- bitnami wordpress-multisite 5.7.1
- wordpress wordpress 5.7.1
- wordpress Debian 14, Debian 13, Debian 12 5.7.1+dfsg1-1
debian advisories DEBIAN-CVE-2021-29447
- wordpress Arch Linux 5.7.1-1
arch linux advisories AVG-1831
Timeline
- Published
- First public exploit (EDB-50304)
Exploit prediction
85.72% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-50304 WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated) webapps, 2021-09-20
- packetstormsecurity.com http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.html referenced PoC, tagged "exploit" by a source, unverified
- blog.sonarsource.com https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | wordpress | >=5.6.0, <5.7.1 |
5.7.1 |
| bitnami | wordpress-multisite | >=5.6.0, <5.7.1 |
5.7.1 |
Affected products
- WordPress wordpress-develop
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
- Technology feeds
References
-
packetstormsecurity.com
/files/164198/WordPress-5.7-Media-Library-XML-Injection.html
exploit, third-party-advisory, vdb-entry, advisory
-
blog.sonarsource.com
/wordpress-xxe-security-vulnerability/
exploit, third-party-advisory, advisory
-
debian.org
/security/2021/dsa-4896
vendor-advisory, third-party-advisory, advisory
-
wordpress.org
/news/category/security/
release-notes, vendor-advisory, advisory
-
github.com
/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc52-qrhh
third-party-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2021/04/msg00017.html
mailing-list, third-party-advisory, advisory
-
packetstormsecurity.com
/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.html
third-party-advisory, vdb-entry, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-29447
web
Sources
- CVE List CVE-2021-29447
- NVD CVE-2021-29447
- OSV BIT-wordpress-2021-29447
- OSV BIT-wordpress-multisite-2021-29447
- Maintainer advisory GHSA-rv47-pc52-qrhh
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of WordPress/wordpress-develop published their own advisory on GitHub. Reviewed sources take precedence over it.