CVE-2021-47888

HIGH 8.8

Textpattern 4.8.3 - Remote code execution

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files. Attackers can upload a PHP file with a shell command execution payload and execute arbitrary commands by accessing the uploaded file through a specific URL parameter.

CWE	CWE-434
Vendor	the textpattern development team
Product	textpattern
Published	Jan 23, 2026
Last Updated	Mar 5, 2026

Stay Ahead of the Next One

Get instant alerts for the textpattern development team textpattern

Be the first to know when new high vulnerabilities affecting the textpattern development team textpattern are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

The Textpattern Development Team / Textpattern

4.8.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/49620 textpattern.com: https://textpattern.com/ textpattern.com: https://textpattern.com/start vulncheck.com: https://www.vulncheck.com/advisories/textpattern-remote-code-execution

Credits

Ricardo Ruiz (@ricardojoserf)