BIT-wordpress-multisite-2021-44223

vendorUSosv

view advisory published 2024-03-06Licence: per source

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-44223US	critical9.8OT high	29.0% (98th)	—	2021-11-25
WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress…

references

External citations — patches, advisories, analysis.

https://make.wordpress.org/core/2021/06/29/introducing-update-uri-plugin-header-in-wordpress-5-8/ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-44223WEB
https://vavkamil.cz/2021/11/25/wordpress-plugin-confusion-update-can-get-you-pwned/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan