WordPress wordpress core

WordPress <= 6.9.1 — Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload

aa7b7474-c170-42a2-be88-0fe410a2e71bPublished Mar 10, 2026 · Updated Nov 13, 2026

Affected: ≤6.9.1Update to 6.8.4 or 6.9.2 or newer

Fixed versions are per release branch: update to the fix for the branch you run.

All remediation steps

Watch core

Medium6.5CVSS 3.16.5CISA KEVNot listedAccessLow-privilege account (e.g. subscriber)

On this page3

Overview

Advisory ID: aa7b7474-c170-42a2-be88-0fe410a2e71b
Product: WordPress wordpress
Affected: ≤6.9.1
Fixed in: 6.8.4, 6.9.2
Weakness: CWE-611 Improper Restriction of XML External Entity Reference
Required access: Low-privilege account (e.g. subscriber)
Published: Mar 10, 2026 · updated Nov 13, 2026
Credit: Youssef Achtatal

Affected≤ 6.9.1
Patched in6.8.4 / 6.9.2

6.5

CVSS 3.1 · CNA (Wordfence)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What does this vector mean?

AV:N Attack vector: Network
AC:L Attack complexity: Low
PR:L Privileges required: Low
UI:N User interaction: None
S:U Scope: Unchanged
C:H Confidentiality: High
I:N Integrity: None
A:N Availability: None

WordPress core is vulnerable to XML External Entity (XXE) Injection via the bundled getID3 library in all versions up to and including 6.9.1. This is due to the GETID3_LIBXML_OPTIONS constant including the LIBXML_NOENT flag, which enables XML entity substitution during parsing.

When WordPress processes media files containing XML metadata (specifically iXML chunks in WAV/RIFF/AVI files), the getID3 library parses the XML with entity substitution enabled, allowing local file disclosure via file:// protocol URIs. This may make it possible for authenticated attackers with Author-level access to read arbitrary files from the server.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

Update to one of the following versions, or a newer patched version: 6.8.4, 6.9.2
Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.

References & provenance

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

Advisorywordfence.com

Timeline

Mar 10, 2026
CVE published
Severity medium, CVSS 6.5
Nov 13, 2026
Record last updated

Sources & licenses

Vulnerability data: Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVSS / CWE: National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.

How we use these sources