Cyber Resilience

CVE-2021-47979

HighPublic PoC

Published: 16 May 2026

Published
16 May 2026
Modified
18 May 2026
KEV Added
—
Patch
—
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0040 31.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2021-47979 is a high-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, ranked at the 31.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete…

more

arbitrary files from the WordPress installation directory.

CWE(s)
CWE-22

Related Threats

CVEs Like This One

CVE-2026-24970Shared CWE-22
CVE-2025-24406Shared CWE-22
CVE-2020-36939Shared CWE-22
CVE-2026-27523Shared CWE-22
CVE-2026-24848Shared CWE-22
CVE-2026-44243Shared CWE-22
CVE-2025-2505Shared CWE-22
CVE-2026-4350Shared CWE-22
CVE-2026-5841Shared CWE-22
CVE-2026-33242Shared CWE-22

Affected Assets

Wordpress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References