Exploitation Summary
EIP tracks 1 public exploit for CVE-2021-47933. PoCs published by spacehen.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in the WordPress MStore API plugin (version 2.0.6 or lower). It uploads a malicious file by exploiting an unauthenticated endpoint, allowing remote code execution if the uploaded file contains executable code.
Description
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.
Exploits (1)
This exploit demonstrates an arbitrary file upload vulnerability in the WordPress MStore API plugin (version 2.0.6 or lower). It uploads a malicious file by exploiting an unauthenticated endpoint, allowing remote code execution if the uploaded file contains executable code.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H