{"url":"http://public2.vulnerablecode.io/api/packages/245218?format=json","purl":"pkg:composer/rmccue/requests@1.6.0","type":"composer","namespace":"rmccue","name":"requests","version":"1.6.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"1.8.0","latest_non_vulnerable_version":"1.8.0","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/34628?format=json","vulnerability_id":"VCID-fra3-hye6-kqh7","summary":"Insecure Deserialization of untrusted data in rmccue/requests\n### Impact\nUnserialization of untrusted data.\n\n### Patches\nThe issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.\n\n### References\nPublications about the vulnerability:\n* https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress\n* https://github.com/ambionics/phpggc/issues/52\n* https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/\n* https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf\n* https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf\n* https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf\n* https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f\n\nOriginally fixed in WordPress 5.5.2:\n* https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3\n* https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/\n\nRelated Security Advisories:\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28032\n* https://nvd.nist.gov/vuln/detail/CVE-2020-28032\n\nNotification to the Requests repo including a fix in:\n* https://github.com/rmccue/Requests/pull/421 and\n* https://github.com/rmccue/Requests/pull/422\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Request](https://github.com/WordPress/Requests/)","references":[{"reference_url":"https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-29476","reference_id":"","reference_type":"","scores":[{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84551","published_at":"2026-04-29T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84548","published_at":"2026-04-26T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84539","published_at":"2026-04-24T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84512","published_at":"2026-04-21T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.8451","published_at":"2026-04-18T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84489","published_at":"2026-04-13T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84493","published_at":"2026-04-12T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.845","published_at":"2026-04-11T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84433","published_at":"2026-04-02T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84567","published_at":"2026-05-05T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84475","published_at":"2026-04-08T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84454","published_at":"2026-04-07T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84452","published_at":"2026-04-04T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84418","published_at":"2026-04-01T12:55:00Z"},{"value":"0.02219","scoring_system":"epss","scoring_elements":"0.84481","published_at":"2026-04-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-29476"},{"reference_url":"https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security"},{"reference_url":"https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/","reference_id":"","reference_type":"","scores":[],"url":"https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/"},{"reference_url":"https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29476","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29476"},{"reference_url":"https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress"},{"reference_url":"https://github.com/ambionics/phpggc/issues/52","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ambionics/phpggc/issues/52"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/rmccue/requests/CVE-2021-29476.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/rmccue/requests/CVE-2021-29476.yaml"},{"reference_url":"https://github.com/rmccue/Requests/pull/421","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rmccue/Requests/pull/421"},{"reference_url":"https://github.com/WordPress/Requests/security/advisories/GHSA-52qp-jpq7-6c54","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/WordPress/Requests/security/advisories/GHSA-52qp-jpq7-6c54"},{"reference_url":"https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3"},{"reference_url":"https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf"},{"reference_url":"https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29476","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29476"},{"reference_url":"https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release"},{"reference_url":"https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/","reference_id":"","reference_type":"","scores":[],"url":"https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/"},{"reference_url":"https://github.com/advisories/GHSA-52qp-jpq7-6c54","reference_id":"GHSA-52qp-jpq7-6c54","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-52qp-jpq7-6c54"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/73809?format=json","purl":"pkg:composer/rmccue/requests@1.8.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/rmccue/requests@1.8.0"}],"aliases":["CVE-2021-29476","GHSA-52qp-jpq7-6c54"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fra3-hye6-kqh7"}],"fixing_vulnerabilities":[],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/rmccue/requests@1.6.0"}