CVE-2021-29447

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
WordPress	wordpress-develop	>= 5.6.0, < 5.7.1

References

http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/Exploit, Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc52-qrhhThird Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00017.htmlMailing List, Third Party Advisory
https://wordpress.org/news/category/security/Release Notes, Vendor Advisory
https://www.debian.org/security/2021/dsa-4896Third Party Advisory
http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/Exploit, Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc52-qrhhThird Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00017.htmlMailing List, Third Party Advisory
https://wordpress.org/news/category/security/Release Notes, Vendor Advisory
https://www.debian.org/security/2021/dsa-4896Third Party Advisory

Timeline

Published: Apr 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294488.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal,CVE-2021-294497.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were CVE-2021-294504.3Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts a CVE-2021-294519.1Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Toke CVE-2021-294526.5a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in versi CVE-2021-294536.5matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properl CVE-2021-294548.8Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 CVE-2021-294555.3Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income commun CVE-2021-294565.4Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your appli CVE-2021-294577.8Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer ove CVE-2021-294585.5Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds CVE-2021-294596.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inje