{
  "cveId": "CVE-2021-44223",
  "url": "https://patchblox.com/security/cve/CVE-2021-44223",
  "summary": "CVE-2021-44223 is fixed in wordpress on 1 platform, first by DEBIAN-CVE-2021-44223, released November 25, 2021. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "wordpress: WordPress before 5.8 lacks support for the Update URI plugin header",
  "description": "WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.",
  "published": "2021-11-25T15:15:09Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.28983,
  "epssPercentile": 0.98172,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "wordpress",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.8.1\u002Bdfsg1-1",
      "fix": "DEBIAN-CVE-2021-44223",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-44223",
      "released": "2021-11-25T15:15:09Z"
    },
    {
      "platform": "linux",
      "product": "wordpress",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.8.1\u002Bdfsg1-1",
      "fix": "DEBIAN-CVE-2021-44223",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-44223",
      "released": "2021-11-25T15:15:09Z"
    },
    {
      "platform": "linux",
      "product": "wordpress",
      "release": "Debian 14",
      "fixedVersion": "5.8.1\u002Bdfsg1-1",
      "fix": "DEBIAN-CVE-2021-44223",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-44223",
      "released": "2021-11-25T15:15:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}