Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2021-47940WordPress Download From Files 1.48 Arbitrary File Upload

Critical 9.8

In plain English

A critical-severity missing authentication in Download From Files from download-from-files. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX fileupload action. Attackers can send POST requests to the admin-ajax.php endpoint with the download_from_files_617_fileupload action, manipulating the allowExt parameter to bypass file type restrictions and upload executable files like PHP shells to the web root.

Affected products (as reported)

Vendor	Product	Versions
download-from-files	Download From Files	0 – through 1.48

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ExploitDB-50287 exploit
Official Product Homepage product
VulnCheck Advisory: WordPress Download From Files 1.48 Arbitrary File Upload third-party-advisory