{"id":"CVE-2021-47965","state":"PUBLISHED","title":"WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload","description":"WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise.","publishedAt":"2026-05-15T18:36:31.362Z","updatedAt":"2026-05-25T23:41:17.885Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["wp-super-edit WP Super Edit"],"affected":[{"vendor":"wp-super-edit","product":"WP Super Edit","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.5.4","versionType":"custom"}]}],"references":["https://www.exploit-db.com/exploits/49839","https://wordpress.org","https://wordpress.org/plugins/wp-super-edit/","https://www.vulncheck.com/advisories/wordpress-plugin-wp-super-edit-unrestricted-file-upload"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47965.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47965","state":"PUBLISHED","datePublished":"2026-05-15T18:36:31.362Z","dateUpdated":"2026-05-25T23:41:17.885Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-05-15T16:35:45.714Z"},"containers":{"cna":{"title":"WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload","descriptions":[{"lang":"en","value":"WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise."}],"affected":[{"vendor":"wp-super-edit","product":"WP Super Edit","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.5.4","versionType":"custom"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/49839","name":"ExploitDB-49839","tags":["exploit"]},{"url":"https://wordpress.org","name":"Official Product Homepage","tags":["product"]},{"url":"https://wordpress.org/plugins/wp-super-edit/","name":"Product Reference","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/wordpress-plugin-wp-super-edit-unrestricted-file-upload","name":"VulnCheck Advisory: WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-25T23:41:17.885Z"},"credits":[{"lang":"en","value":"h4shur","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-15T20:09:37.672278Z","id":"CVE-2021-47965","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-15T20:10:17.554Z"}}]}}}