What is CVE-2021-44223?

CVE-2021-44223 is a high-severity vulnerability in Wordpress. CVSS score: 8.1/10. Published 2021-11-25.

How severe is CVE-2021-44223?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2021-44223 known to be exploited?

6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Wordpress

CVE-2021-44223

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

EPSS: 0.290 (98.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Wordpress
N/a — versions n/a

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2021-44223?: CVE-2021-44223 is a high-severity vulnerability in Wordpress. CVSS score: 8.1/10. Published 2021-11-25.
How severe is CVE-2021-44223?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2021-44223 known to be exploited?: 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.