CVE-2021-47965
WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload
- State
- Published
- Severity
- 9.3 Critical
- Published
- May 15, 2026
- Updated
- May 25, 2026
- Reserved
- May 15, 2026
Description
WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
WP Super Editwp-super-edit |
|
References
- ExploitDB-49839exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.