Vulnerability · Published May 15, 2026 · Assigned by VulnCheck
CVE-2021-47965WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload
Critical 9.8
In plain English
A critical-severity unrestricted file upload in WP Super Edit from wp-super-edit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 51.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wp-super-edit | WP Super Edit | 0 – through 2.5.4 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-49839 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload third-party-advisory