CVE-2021-44223

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://make.wordpress.org/core/2021/06/29/introducing-update-uri-plugin-header-in-wordpress-5-8/Release Notes, Vendor Advisory
https://vavkamil.cz/2021/11/25/wordpress-plugin-confusion-update-can-get-you-pwned/Exploit, Third Party Advisory
https://make.wordpress.org/core/2021/06/29/introducing-update-uri-plugin-header-in-wordpress-5-8/Release Notes, Vendor Advisory
https://vavkamil.cz/2021/11/25/wordpress-plugin-confusion-update-can-get-you-pwned/Exploit, Third Party Advisory

Timeline

Published: Nov 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-442248.2A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurat CVE-2021-442255.4In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manip CVE-2021-442267.3Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROG CVE-2021-442278.8In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new adm CVE-2021-4422810.0Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log mess CVE-2021-44234.3The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missi CVE-2021-442306.5PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead CVE-2021-442319.8Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby CVE-2021-442327.7SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leadi CVE-2021-442338.8SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user CVE-2021-442345.5SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker CVE-2021-442356.7Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756