Quick answers
- Is CVE-2021-47976 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-47976 being exploited in the wild.
- How severe is CVE-2021-47976?
- High severity, with a CVSS score of 8.8, published 16 May 2026.
- Which products and versions are affected?
- Textpattern CMS 4.9.0-dev.
- Is there a fix for CVE-2021-47976?
- A patch was published on 2026-02-14: Textpattern 4.9.1 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-47976 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2021-47976?
- Check whether you run Textpattern CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authenticated remote code execution (RCE) vulnerability exists in Textpattern CMS 4.9.0-dev due to insufficient validation in the plugin upload functionality. An attacker with low-privileged authentication can bypass security checks by retrieving a valid CSRF token from the plugin event page and then uploading a malicious PHP file. The application stores these uploaded files in the 'textpattern/tmp/' directory, where they can be directly accessed and executed by the attacker. This allows for arbitrary command execution on the underlying server. The issue is reportedly addressed in version 4.9.1.
Affected products
- Textpattern Textpattern CMS 4.9.0-dev
Timeline
- 2021-07-04: other: Exploit code published on Exploit-DB
- 2026-02-14: patched: Textpattern 4.9.1 released with security fixes
- 2026-05-16: disclosed: CVE published to NVD