{"id":"CVE-2021-29447","published":"2021-04-15T21:10:12Z","modified":"2024-08-03T22:02:51Z","title":"WordPress Authenticated XXE attack when installation is running PHP 8","vendor":"WordPress","product":"wordpress-develop","tier":"core","eol":null,"affectedVersions":[{"vendor":"WordPress","product":"wordpress-develop","versions":[">= 5.6.0, < 5.7.1"]}],"description":{"text":"Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.","provenance":"source","from":"CVE.org"},"summary":{"text":"An XML external entity (XXE) processing flaw in WordPress's Media Library, in the wordpress-develop codebase, lets a user with file upload rights, such as an Author, trigger XML parsing that can read internal files. An attacker needs low-privilege authenticated access and no user interaction, and the issue only applies when the installation runs on PHP 8.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:47Z"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.85719,"percentile":0.99726,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"Discernment Deleted: Inside the Operation Server of BlackHatSect0r && DXQRTXX","url":"https://otx.alienvault.com/pulse/6ab0bcaa4522ee16948cdd9e","created":"2026-09-21"},{"name":"Discernment Deleted: Inside the Operation Server of BlackHatSect0r && DXQRTXX","url":"https://otx.alienvault.com/pulse/6aabd1f78ff5217e83133504","created":"2026-09-17"},{"name":"BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials","url":"https://otx.alienvault.com/pulse/6aabc7441666597c3a27a283","created":"2026-09-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc52-qrhh","tags":["x_refsource_CONFIRM"]},{"url":"https://wordpress.org/news/category/security/","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00017.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2021/dsa-4896","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.html","tags":["x_refsource_MISC"]},{"url":"https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-16064","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-16064","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":50304,"url":"https://www.exploit-db.com/exploits/50304","title":"WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)","type":"webapps","platform":"php","date":"2021-09-20","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2021-09-20"},"pocGithub":{"count":18,"skipped":6,"earliest":"2021-04-16","earliestUrl":"https://github.com/motikan2010/CVE-2021-29447","repos":[{"name":"motikan2010/CVE-2021-29447","url":"https://github.com/motikan2010/CVE-2021-29447","stars":44,"created":"2021-04-16"},{"name":"mega8bit/exploit_cve-2021-29447","url":"https://github.com/mega8bit/exploit_cve-2021-29447","stars":7,"created":"2022-11-14"},{"name":"0xRar/CVE-2021-29447-PoC","url":"https://github.com/0xRar/CVE-2021-29447-PoC","stars":6,"created":"2023-01-24"},{"name":"Vulnmachines/wordpress_cve-2021-29447","url":"https://github.com/Vulnmachines/wordpress_cve-2021-29447","stars":4,"created":"2021-05-23"},{"name":"M3l0nPan/wordpress-cve-2021-29447","url":"https://github.com/M3l0nPan/wordpress-cve-2021-29447","stars":4,"created":"2022-11-11"}]},"first":{"date":"2021-04-16","source":"PoC-in-GitHub","url":"https://github.com/motikan2010/CVE-2021-29447"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.html","http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.html"],"flow":[],"timeline":[{"date":"2021-04-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-29447","provenance":"source"},{"date":"2021-04-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2021-09-20","url":"https://github.com/motikan2010/CVE-2021-29447","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 NVD exploit links; 18 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":4.97,"detail":"base score 7.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}