Arbitrary Code Execution Affecting johnpbloch/wordpress-core package, versions <5.8
Threat Intelligence
EPSS
0.85% (83rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-JOHNPBLOCHWORDPRESSCORE-2407758
- published 21 Feb 2022
- disclosed 25 Nov 2021
- credit Unknown
Introduced: 25 Nov 2021
CVE-2021-44223 Open this link in a new tabHow to fix?
Upgrade johnpbloch/wordpress-core to version 5.8 or higher.
Overview
johnpbloch/wordpress-core is a web software you can use to create a website or blog.
Affected versions of this package are vulnerable to Arbitrary Code Execution via missing support for the Update URI Plugin header, which makes it easy for malicious actors to execute code by abusing the supply-chain for any Wordpress website that uses a plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.
CVSS Scores
version 3.1