CVE-2021-29447

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.

• CWE-611
• CWE-611

• http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/Exploit, Third Party Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc52-qrhhThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/04/msg00017.htmlMailing List, Third Party Advisory
• https://wordpress.org/news/category/security/Release Notes, Vendor Advisory
• https://www.debian.org/security/2021/dsa-4896Third Party Advisory
• http://packetstormsecurity.com/files/163148/XML-External-Entity-Via-MP3-File-Upload-On-WordPress.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/164198/WordPress-5.7-Media-Library-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/Exploit, Third Party Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc52-qrhhThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/04/msg00017.htmlMailing List, Third Party Advisory
• https://wordpress.org/news/category/security/Release Notes, Vendor Advisory
• https://www.debian.org/security/2021/dsa-4896Third Party Advisory

Published

Apr 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29441Nacos is a platform designed for dynamic service discovery a…9.8
• CVE-2021-29442Nacos is a platform designed for dynamic service discovery a…7.5
• CVE-2021-29443jose is an npm library providing a number of cryptographic o…5.9
• CVE-2021-29444jose-browser-runtime is an npm package which provides a numb…5.9
• CVE-2021-29445jose-node-esm-runtime is an npm package which provides a num…5.9
• CVE-2021-29446jose-node-cjs-runtime is an npm package which provides a num…5.9
• CVE-2021-29448Pi-hole is a Linux network-level advertisement and Internet …8.8
• CVE-2021-29449Pi-hole is a Linux network-level advertisement and Internet …7.8
• CVE-2021-29450Wordpress is an open source CMS. One of the blocks in the Wo…4.3
• CVE-2021-29451Portofino is an open source web development framework. Porto…9.1
• CVE-2021-29452a12n-server is an npm package which aims to provide a simple…6.5
• CVE-2021-29453matrix-media-repo is an open-source multi-domain media repos…6.5