Skip to content
OpenAdvisories
High DLA-2630-1 2 CVEs

wordpress - security update

Published Apr 21, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 wordpress 4.7.20+dfsg-1+deb9u1

Vulnerabilities 2

  • High 7.1
    CVE-2021-29447 Public exploit EPSS 86%

    WordPress Authenticated XXE attack when installation is running PHP 8

    Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possibl…

    WordPress wordpress-develop wordpress wordpress Web / CMS Debian Ubuntu
  • Medium 6.5
    CVE-2021-29450

    WordPress Authenticated disclosure of password-protected posts and pages

    Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older…

    WordPress wordpress-develop wordpress wordpress Web / CMS Debian Ubuntu