Vulnerability · Published May 10, 2026 · Assigned by VulnCheck
CVE-2021-47933WordPress MStore API 2.0.6 Arbitrary File Upload
Critical 9.8
In plain English
A critical-severity missing authentication in MStore API from mstore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 51.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mstore | MStore API | 2.0.6 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50379 exploit
- Official Product Homepage product
- VulnCheck Advisory: WordPress MStore API 2.0.6 Arbitrary File Upload third-party-advisory