Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/wp-cli/wp-cli@0.12.1
purl pkg:composer/wp-cli/wp-cli@0.12.1
Next non-vulnerable version 2.5.0
Latest non-vulnerable version 2.5.0
Risk 4.5
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-gmyb-736y-jqgy
Aliases:
CVE-2021-29504
GHSA-rwgm-f83r-v3qj
Improper Certificate Validation WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request.
2.5.0
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-06T00:44:00.775966+00:00 GitLab Importer Affected by VCID-gmyb-736y-jqgy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/wp-cli/wp-cli/CVE-2021-29504.yml 38.6.0