CVE-2021-44223

WordPress before 5.8 lacks support for the Update URI plugin header

High · published November 25, 2021

CVSS v3.1

8.1

EPSS

29%

Percentile

98.2

In the wild

Unconfirmed

What it is

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
CVSS v4.0: Not supplied
EPSS: 0.28983 · 98.2th percentile
Published: 2021-11-25T14:51Z

EPSS history

Timeline

25 NOV 14:51Z
WordPress before 5.8 lacks support for the Update URI plugin header
cvelistv5