GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-29504 (GCVE-0-2021-29504)

Vulnerability from cvelistv5 – Published: 2021-06-07 20:50 – Updated: 2024-08-03 22:11
VLAI
Title
Improper Certificate Validation in WP-CLI framework
Summary
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Vendor Product Version CPE status
wp-cli wp-cli Affected: < 2.5.0
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:11:05.507Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/wp-cli/checksum-command/pull/86"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/wp-cli/config-command/pull/128"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/wp-cli/core-command/pull/186"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/wp-cli/extension-command/pull/287"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/wp-cli/package-command/pull/138"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/wp-cli/wp-cli/pull/5523"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wp-cli",
          "vendor": "wp-cli",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\\Utils\\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\\Utils\\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\\Utils\\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-07T20:50:17.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wp-cli/checksum-command/pull/86"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wp-cli/config-command/pull/128"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wp-cli/core-command/pull/186"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wp-cli/extension-command/pull/287"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wp-cli/package-command/pull/138"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wp-cli/wp-cli/pull/5523"
        }
      ],
      "source": {
        "advisory": "GHSA-rwgm-f83r-v3qj",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Certificate Validation in WP-CLI framework",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-29504",
          "STATE": "PUBLIC",
          "TITLE": "Improper Certificate Validation in WP-CLI framework"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "wp-cli",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 2.5.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "wp-cli"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\\Utils\\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\\Utils\\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\\Utils\\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-295: Improper Certificate Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj",
              "refsource": "CONFIRM",
              "url": "https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj"
            },
            {
              "name": "https://github.com/wp-cli/checksum-command/pull/86",
              "refsource": "MISC",
              "url": "https://github.com/wp-cli/checksum-command/pull/86"
            },
            {
              "name": "https://github.com/wp-cli/config-command/pull/128",
              "refsource": "MISC",
              "url": "https://github.com/wp-cli/config-command/pull/128"
            },
            {
              "name": "https://github.com/wp-cli/core-command/pull/186",
              "refsource": "MISC",
              "url": "https://github.com/wp-cli/core-command/pull/186"
            },
            {
              "name": "https://github.com/wp-cli/extension-command/pull/287",
              "refsource": "MISC",
              "url": "https://github.com/wp-cli/extension-command/pull/287"
            },
            {
              "name": "https://github.com/wp-cli/package-command/pull/138",
              "refsource": "MISC",
              "url": "https://github.com/wp-cli/package-command/pull/138"
            },
            {
              "name": "https://github.com/wp-cli/wp-cli/pull/5523",
              "refsource": "MISC",
              "url": "https://github.com/wp-cli/wp-cli/pull/5523"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-rwgm-f83r-v3qj",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-29504",
    "datePublished": "2021-06-07T20:50:17.000Z",
    "dateReserved": "2021-03-30T00:00:00.000Z",
    "dateUpdated": "2024-08-03T22:11:05.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-29504",
      "date": "2026-09-17",
      "epss": "0.01312",
      "percentile": "0.69292"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:wp-cli:wp-cli:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"0.12.0\", \"versionEndExcluding\": \"2.5.0\", \"matchCriteriaId\": \"7905C5F9-7215-431B-87D0-B302B66363D9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\\\\Utils\\\\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\\\\Utils\\\\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\\\\Utils\\\\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.\"}, {\"lang\": \"es\", \"value\": \"WP-CLI es la interfaz de l\\u00ednea de comandos para WordPress. Un manejo inapropiado de errores en la administraci\\u00f3n de peticiones HTTPS en la versi\\u00f3n 0.12.0 y posteriores de WP-CLI, permite a atacantes remotos capaces de interceptar la comunicaci\\u00f3n desactivar remotamente la comprobaci\\u00f3n del certificado en el lado de WP-CLI, obteniendo un control total sobre el contenido de la comunicaci\\u00f3n, incluyendo la habilidad de hacerse pasar por servidores de actualizaci\\u00f3n y empujar actualizaciones maliciosas hacia instancias de WordPress controladas por el agente vulnerable de WP-CLI, o empujar actualizaciones maliciosas hacia el propio WP-CLI. La vulnerabilidad proviene del hecho de que el comportamiento por defecto de la funci\\u00f3n \\\"WP_CLI\\\\Utils\\\\http_request()\\\" cuando se encuentra un error de protocolo de enlace TLS es desactivar la comprobaci\\u00f3n del certificado y volver a intentar la misma petici\\u00f3n. El comportamiento por defecto ha sido cambiado con la versi\\u00f3n 2.5.0 de WP-CLI y el framework \\\"wp-cli/wp-cli\\\" (por medio de https://github.com/wp-cli/wp-cli/pull/5523) para que el m\\u00e9todo \\\"WP_CLI\\\\Utils\\\\http_request()\\\" acepte una opci\\u00f3n \\\"$insecure\\\" que es \\\"false\\\" por defecto y en consecuentemente un fallo de protocolo de enlace TLS es un error duro por defecto. Este nuevo valor por defecto es un cambio de ruptura y se extiende a todos los consumidores de la funci\\u00f3n \\\"WP_CLI\\\\Utils\\\\http_request()\\\", incluyendo aquellos en paquetes separados de WP-CLI o de terceros. https://github.com/wp-cli/wp-cli/pull/5523 tambi\\u00e9n ha a\\u00f1adido un flag \\\"--insecure\\\" al comando \\\"cli update\\\" para contrarrestar este cambio de ruptura. No hay una soluci\\u00f3n directa para el comportamiento no seguro por defecto de las versiones anteriores a 2.5.0 de \\\"wp-cli/wp-cli\\\". La soluci\\u00f3n para tratar el cambio de ruptura en los comandos directamente afectados por el nuevo comportamiento seguro por defecto es a\\u00f1adir el flag \\\"--insecure\\\" para optar manualmente por el comportamiento no seguro anterior\"}]",
      "id": "CVE-2021-29504",
      "lastModified": "2024-11-21T06:01:15.860",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 7.4, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.2}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-06-07T21:15:08.387",
      "references": "[{\"url\": \"https://github.com/wp-cli/checksum-command/pull/86\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/config-command/pull/128\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/core-command/pull/186\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/extension-command/pull/287\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/package-command/pull/138\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/wp-cli/pull/5523\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/checksum-command/pull/86\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/config-command/pull/128\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/core-command/pull/186\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/extension-command/pull/287\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/package-command/pull/138\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/wp-cli/pull/5523\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-295\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-29504\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-06-07T21:15:08.387\",\"lastModified\":\"2024-11-21T06:01:15.860\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\\\\Utils\\\\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\\\\Utils\\\\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\\\\Utils\\\\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.\"},{\"lang\":\"es\",\"value\":\"WP-CLI es la interfaz de l\u00ednea de comandos para WordPress. Un manejo inapropiado de errores en la administraci\u00f3n de peticiones HTTPS en la versi\u00f3n 0.12.0 y posteriores de WP-CLI, permite a atacantes remotos capaces de interceptar la comunicaci\u00f3n desactivar remotamente la comprobaci\u00f3n del certificado en el lado de WP-CLI, obteniendo un control total sobre el contenido de la comunicaci\u00f3n, incluyendo la habilidad de hacerse pasar por servidores de actualizaci\u00f3n y empujar actualizaciones maliciosas hacia instancias de WordPress controladas por el agente vulnerable de WP-CLI, o empujar actualizaciones maliciosas hacia el propio WP-CLI. La vulnerabilidad proviene del hecho de que el comportamiento por defecto de la funci\u00f3n \\\"WP_CLI\\\\Utils\\\\http_request()\\\" cuando se encuentra un error de protocolo de enlace TLS es desactivar la comprobaci\u00f3n del certificado y volver a intentar la misma petici\u00f3n. El comportamiento por defecto ha sido cambiado con la versi\u00f3n 2.5.0 de WP-CLI y el framework \\\"wp-cli/wp-cli\\\" (por medio de https://github.com/wp-cli/wp-cli/pull/5523) para que el m\u00e9todo \\\"WP_CLI\\\\Utils\\\\http_request()\\\" acepte una opci\u00f3n \\\"$insecure\\\" que es \\\"false\\\" por defecto y en consecuentemente un fallo de protocolo de enlace TLS es un error duro por defecto. Este nuevo valor por defecto es un cambio de ruptura y se extiende a todos los consumidores de la funci\u00f3n \\\"WP_CLI\\\\Utils\\\\http_request()\\\", incluyendo aquellos en paquetes separados de WP-CLI o de terceros. https://github.com/wp-cli/wp-cli/pull/5523 tambi\u00e9n ha a\u00f1adido un flag \\\"--insecure\\\" al comando \\\"cli update\\\" para contrarrestar este cambio de ruptura. No hay una soluci\u00f3n directa para el comportamiento no seguro por defecto de las versiones anteriores a 2.5.0 de \\\"wp-cli/wp-cli\\\". La soluci\u00f3n para tratar el cambio de ruptura en los comandos directamente afectados por el nuevo comportamiento seguro por defecto es a\u00f1adir el flag \\\"--insecure\\\" para optar manualmente por el comportamiento no seguro anterior\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wp-cli:wp-cli:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.12.0\",\"versionEndExcluding\":\"2.5.0\",\"matchCriteriaId\":\"7905C5F9-7215-431B-87D0-B302B66363D9\"}]}]}],\"references\":[{\"url\":\"https://github.com/wp-cli/checksum-command/pull/86\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/config-command/pull/128\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/core-command/pull/186\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/extension-command/pull/287\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/package-command/pull/138\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/wp-cli/pull/5523\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/checksum-command/pull/86\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/config-command/pull/128\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/core-command/pull/186\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/extension-command/pull/287\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/package-command/pull/138\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/wp-cli/pull/5523\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T16:16:49+00:00",
      "cve": "CVE-2021-29504",
      "id": "CVE-2021-29504",
      "initial_release_date": "2021-06-07T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "wp-cli: improper error handling allows remote attackers to gain full control over the communication content",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29504.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-03-15T09:01:32Z",
      "cve": "CVE-2021-29504",
      "id": "CVE-2021-29504",
      "initial_release_date": "2023-02-15T03:43:30Z",
      "product_status:recommended": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-29504",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-29504.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.