CVSS v3
9.8
CRITICAL
EPSS Score
27.5%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.
WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.
Active exploitation of CVE-2021-44223 has not been confirmed. The EPSS score is 27.5%, indicating the estimated probability of exploitation in the next 30 days.
CVE-2021-44223 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
Ranked by exploit probability (EPSS).