PT-2021-4050 · WordPress · Wordpress

Ehti · Published 2021-03-30 · Updated 2026-05-10 · CVE-2021-29447

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.7.1

Description The issue is related to an XML parsing problem in the Media Library of WordPress, which can lead to XXE attacks. This vulnerability can be exploited by a user with the ability to upload files, such as an Author, and requires the WordPress installation to be using PHP 8. A successful attack can provide access to internal files.

Recommendations For versions prior to 5.7.1, update to WordPress version 5.7.1 or later to resolve the issue. As a temporary workaround, consider restricting file upload permissions to minimize the risk of exploitation. Keep auto-updates enabled to ensure the latest security patches are applied.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-04578

BIT-WORDPRESS-2021-29447

BIT-WORDPRESS-MULTISITE-2021-29447

CVE-2021-29447

DLA-2630-1

DSA-4896-1

GHSA-RV47-PC52-QRHH

Affected Products

Wordpress

References · 46

• 🔥 https://github.com/motikan2010/CVE-2021-29447 · Exploit
• 🔥 https://github.com/Vulnmachines/wordpress_cve-2021-29447 · Exploit
• 🔥 https://github.com/mega8bit/exploit_cve-2021-29447 · Exploit
• 🔥 https://github.com/0xRar/CVE-2021-29447-PoC · Exploit
• 🔥 https://github.com/M3l0nPan/wordpress-cve-2021-29447 · Exploit
• 🔥 https://github.com/dnr6419/CVE-2021-29447 · Exploit
• 🔥 https://github.com/thomas-osgood/CVE-2021-29447 · Exploit
• 🔥 https://github.com/elf1337/blind-xxe-controller-CVE-2021-29447 · Exploit
• 🔥 http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.html · Exploit
• 🔥 https://blog.sonarsource.com/wordpress-xxe-security-vulnerability · Exploit
• 🔥 https://exploit-db.com/exploits/50304 · Exploit
• https://debian.org/security/2021/dsa-4896 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2021-29447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29447 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-29447 · Security Note