CVE-2021-44223 — Wordpress vulnerability

5 documents5 sources
Severity
9.8CRITICALNVD
CNA8.1
EPSS
27.5%
top 3.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WordpressDebian Wordpress
Timeline
PublishedNov 25
Latest updateMay 24

Description

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 5.8.1+dfsg1-1 (bookworm)
▶Debianwordpress/wordpress< 5.8.1+dfsg1-1+2

🔴Vulnerability Details

3
GHSA
GHSA-m8cv-g4gv-cx2g: WordPress before 5↗2022-05-24
▶
OSV
CVE-2021-44223: WordPress before 5↗2021-11-25
▶
CVEList
CVE-2021-44223: WordPress before 5↗2021-11-25
▶

📋Vendor Advisories

1
Debian
CVE-2021-44223: wordpress - WordPress before 5.8 lacks support for the Update URI plugin header. This makes ...↗2021
▶