CVE-2021-29504

CVE-2021-29504 affects WP-CLI versions 0.12.0 through 2.4.1, stemming from improper error handling in HTTPS requests that allows remote attackers to disable certificate verification. This vulnerability enables man-in-the-middle attacks, allowing impersonation of update servers and pushing malicious updates to WordPress instances or WP-CLI itself. With a CVSS score of 7.4 (HIGH), the attack requires network access and high attack complexity, but no user interaction, leading to high confidentiality and integrity impacts. While there is no evidence of active exploitation, no public exploit code, and it is not on CISA's KEV catalog, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.