VULNERABILITY INTELLIGENCE

CVE-2021-44223

CVSS score8.1 HIGH

EPSS probability28.98%

CISA KEVNot currently listed

Published2021-11-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

Weakness classification

nvd@nist.gov: NVD-CWE-Other

Primary references

cve@mitre.org — Release Notes, Vendor Advisory
cve@mitre.org — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory