CVE-2021-47888: The Textpattern Development Team Textpattern

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files. Attackers can upload a PHP file with a shell command execution payload and execute arbitrary commands by accessing the uploaded file through a specific URL parameter.

Affected products

Published 2026-01-23. Last modified 2026-06-17.