CVE-2021-47976: Textpattern CMS

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.

Affected products

• Textpattern Textpattern CMS: version 4.9.0-dev only

Published 2026-05-16. Last modified 2026-06-17.