CVE-2021-29447 PoC — WordPress Authenticated XXE attack when installation is running PHP 8

Source

https://github.com/M3l0nPan/wordpress-cve-2021-29447

Associated Vulnerability

Title:WordPress Authenticated XXE attack when installation is running PHP 8 (CVE-2021-29447)
Description:Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.

Description

Exploit WordPress Media Library XML External Entity Injection (XXE) to exfiltrate files.

Readme


# WordPress CVE-2021-29447 exploit

Exploit WordPress Media Library XML authenticated External Entity Injection (XXE) to exfiltrate files.

Patched in WordPress 5.7.1.

Required valid WordPress credentials to interact with Media Library.

## Usage

```
python3 wordpress-cve-2021-29447.py -l http://LOCAL_IP:PORT -r http://WORDPRESS_URL -u USERNAME -p PASSWORD
```

Script will ask for file path and return requested file.

## Credit

Inspired by [David Utón (M3n0sD0n4ld) ExploitDB](https://www.exploit-db.com/exploits/50304) script.

## Disclaimer

Usage of this for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.

## License

This script is released under the [MIT License](https://opensource.org/licenses/MIT).

File Snapshot


 [4.0K]  /data/pocs/d1f720d037b96fe7d75be7afe5cdf17aea8e740c
├── [1.0K]  LICENSE.txt
├── [ 957]  README.md
└── [7.5K]  wordpress-cve-2021-29447.py

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!