CVE-2005-1921: PEAR XML_RPC eval injection allows remote PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution with a very high EPSS score and wide deployment through bundled PHP applications, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

PEAR XML_RPC 1.3.0 and earlier, and PHPXMLRPC 1.1 and earlier, pass unsanitized XML input into an eval statement, creating an eval injection flaw. Because these libraries are bundled into many PHP applications such as WordPress, Drupal, Serendipity, TikiWiki and others, the exposure is broad across the PHP ecosystem. Successful exploitation lets a remote attacker run arbitrary PHP code in the context of the affected application.

Impact

An unauthenticated remote attacker can execute arbitrary PHP code on the server, leading to full compromise of the application and potentially the underlying host. This can expose data, allow web shell placement, and enable lateral movement.

Attack surface

Reachable over the network through XML-RPC endpoints that accept XML input, as reflected by the AV:N/AC:L/Au:N vector. No authentication or user interaction is required per the CVSS vector and description.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high at 0.79 (99.6th percentile), indicating strong likelihood of exploitation activity. Reference tags include a patch link and third-party advisories, with no explicit public exploit tag in the record.

What to do

• Upgrade PEAR XML_RPC to 1.3.1 or later and PHPXMLRPC to a fixed release; apply the vendor patch referenced in the record.
• Update all bundled applications (WordPress, Drupal, Serendipity, TikiWiki, egroupware, MailWatch, phpWebSite, Ampache) to versions that ship the patched library.
• If immediate patching is not possible, disable or restrict access to XML-RPC endpoints at the network or web server layer.
• Audit for and remove any unused XML-RPC functionality to reduce the attack surface.

Detection

• Monitor web and application logs for XML-RPC requests containing PHP code patterns or unusual eval-like payloads.
• Search for unexpected PHP files or modifications in web-accessible directories that could indicate web shell placement.
• Alert on outbound connections or process execution spawned by the web server user that are not part of normal application behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.