CVE-2021-29476: WordPress Requests

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.

Affected products

• WordPress Requests: version 1.6.0 only; version 1.6.1 only; version 1.7.0 only

Published 2021-04-27. Last modified 2026-06-17.