PT-2021-24068 · WordPress+1 · Wordpress+1

Kamil Vavra + 1 · Published 2021-11-25 · Updated 2025-09-11 · CVE-2021-44223

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.8

Description: The issue makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory. This occurs due to the lack of support for the Update URI plugin header in affected versions.

Recommendations: For versions prior to 5.8, update to version 5.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of plugins that are not yet present in the WordPress.org Plugin Directory to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BIT-WORDPRESS-2021-44223

BIT-WORDPRESS-MULTISITE-2021-44223

CVE-2021-44223

Affected Products

Debian

Wordpress

References · 13

• 🔥 https://vavkamil.cz/2021/11/25/wordpress-plugin-confusion-update-can-get-you-pwned · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-44223 · Vendor Advisory
• https://make.wordpress.org/core/2021/06/29/introducing-update-uri-plugin-header-in-wordpress-5-8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44223 · Security Note
• https://osv.dev/vulnerability/BIT-wordpress-2021-44223 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2021-44223 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44223 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44223 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44223 · Security Note
• https://ubuntu.com/security/CVE-2021-44223 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44223 · Vendor Advisory
• https://t.me/cvenotify/23779 · Telegram Post
• https://t.me/cibsecurity/32986 · Telegram Post