CVE-2021-47933 - Vulnerability Analysis

Overview

WordPress MStore API 2.0.6 contains an unrestricted file upload vulnerability caused by lack of proper validation in the config_file REST API endpoint, letting unauthenticated attackers upload malicious PHP files and achieve remote code execution.

Severity & Score

Impact

Unauthenticated attackers can upload malicious files and execute arbitrary code on the server, leading to full server compromise.

Mitigation

Update to the latest version of WordPress MStore API that patches this vulnerability.

References

• https://wordpress.org/plugins/mstore-api/
• https://www.exploit-db.com/exploits/50379
• https://www.vulncheck.com/advisories/wordpress-mstore-api-arbitrary-file-upload

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner