CVE-2021-47965

critical · 9.3

WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise.

9.3

CVSS

0.6%

EPSS (exploit prob.)

47th

EPSS percentile

2026-05-15

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

References

https://wordpress.org
https://wordpress.org/plugins/wp-super-edit/
https://www.exploit-db.com/exploits/49839
https://www.vulncheck.com/advisories/wordpress-plugin-wp-super-edit-unrestricted-file-upload

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-47965