CVE-2021-47940

WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX fileupload action. Attackers can send POST requests to the admin-ajax.php endpoint with the download_from_files_617_fileupload action, manipulating the allowExt parameter to bypass file type restrictions and upload executable files like PHP shells to the web root.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wordpress.org/plugins/download-from-files/
https://www.exploit-db.com/exploits/50287
https://www.vulncheck.com/advisories/wordpress-download-from-files-arbitrary-file-upload

Configurations

No configuration.

History

24 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress Download From Files versión 1.48 y anteriores contiene una vulnerabilidad de carga arbitraria de archivos que permite a atacantes no autenticados cargar archivos maliciosos explotando la acción AJAX fileupload. Los atacantes pueden enviar solicitudes POST al endpoint admin-ajax.php con la acción download_from_files_617_fileupload, manipulando el parámetro allowExt para eludir las restricciones de tipo de archivo y cargar archivos ejecutables como shells PHP a la raíz web.

10 May 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-10 13:16

Updated : 2026-07-25 10:10

NVD link : CVE-2021-47940

Mitre link : CVE-2021-47940

CVE.ORG link : CVE-2021-47940

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2021-47940", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47940", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-11T13:19:46.205460Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "download-from-files", "product": "Download From Files", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.48"}]}]}], "published": "2026-05-10T13:16:30.363", "references": [{"url": "https://wordpress.org/plugins/download-from-files/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/50287", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/wordpress-download-from-files-arbitrary-file-upload", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX fileupload action. Attackers can send POST requests to the admin-ajax.php endpoint with the download_from_files_617_fileupload action, manipulating the allowExt parameter to bypass file type restrictions and upload executable files like PHP shells to the web root."}, {"lang": "es", "value": "El plugin de WordPress Download From Files versi\u00f3n 1.48 y anteriores contiene una vulnerabilidad de carga arbitraria de archivos que permite a atacantes no autenticados cargar archivos maliciosos explotando la acci\u00f3n AJAX fileupload. Los atacantes pueden enviar solicitudes POST al endpoint admin-ajax.php con la acci\u00f3n download_from_files_617_fileupload, manipulando el par\u00e1metro allowExt para eludir las restricciones de tipo de archivo y cargar archivos ejecutables como shells PHP a la ra\u00edz web."}], "lastModified": "2026-07-25T10:10:00.167", "sourceIdentifier": "disclosure@vulncheck.com"}