CVE-2021-44223

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-44223

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-44223.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-44223

Aliases

Downstream

DEBIAN-CVE-2021-44223

UBUNTU-CVE-2021-44223

Published

2021-11-25T15:15:09.800Z

Modified

2026-07-08T23:58:18.792755Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

References

Affected packages

Git / github.com/wordpress/wordpress

Affected ranges

Type

GIT

Repo

https://github.com/wordpress/wordpress

Events

Introduced

Fixed

50caeb6e61ad0c49d2c7e1d6d5115047a011f590

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.8"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-44223.json"

Git / github.com/wordpress/wordpress-develop