GHSA-rwgm-f83r-v3qj · Severity: critical · Ecosystem: composer — Improper Certificate Validation in WP-CLI framework
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.
Conclusion & alert: CVE-2021-29504 is rated Moderate Risk (64/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 1.15%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-01-27 | 0.85% | 1.15% | +0.30% |
| 2 | 2025-11-21 | 1.17% | 0.85% | -0.32% |
| 3 | 2025-11-18 | — | 1.17% | — |
Full EPSS history (15 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.1 | 3.1 | CRITICAL |
|
3.9 | 5.2 | [email protected] |
| 7.4 | 3.1 | HIGH |
|
2.2 | 5.2 | [email protected] |
| 7.5 | 2.0 | HIGH |
|
10.0 | 6.4 | [email protected] |
GHSA-rwgm-f83r-v3qj · Severity: critical · Ecosystem: composer — Improper Certificate Validation in WP-CLI framework
| URL | Tags |
|---|---|
| https://github.com/wp-cli/checksum-command/pull/86 | Patch Third Party Advisory |
| https://github.com/wp-cli/config-command/pull/128 | Patch Third Party Advisory |
| https://github.com/wp-cli/core-command/pull/186 | Patch Third Party Advisory |
| https://github.com/wp-cli/extension-command/pull/287 | Patch Third Party Advisory |
| https://github.com/wp-cli/package-command/pull/138 | Third Party Advisory |
| https://github.com/wp-cli/wp-cli/pull/5523 | Patch Third Party Advisory |
| https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj | Third Party Advisory |