CVE-2021-47933: MStore API for WordPress - Unauthenticated Arbitrary File Upload

Overview

MStore API is a WordPress plugin, and the record names version 2.0.6 as affected. The description states that an arbitrary file upload flaw can be reached without authentication through a REST API endpoint, with the config_file endpoint named as the upload target. The record assigns CWE-306, Missing Authentication for Critical Function.

Impact

• Unauthenticated users may be able to place files on the server, according to the record.
• The record states that uploaded PHP files could lead to remote code execution.
• The CVSS 3.1 vector attributed to VulnCheck indicates high confidentiality, integrity and availability impact, with a base score of 9.8.
• The record also lists a CVSS 4.0 score of 9.3.

Affected products and versions

• Product listed as Mstore MStore API, a WordPress plugin.
• Affected version listed: 2.0.6.
• The record lists no other affected versions, so the full range of vulnerable versions is unknown.
• The record lists no fixed version. That absence does not confirm that no fix exists; check the WordPress plugin page for current release information.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source. No confirmed exploitation in the wild appears in the sources consulted. The record lists an exploit reference on Exploit-DB and an SSVC exploitation value of proof of concept (poc), so exploit material is recorded as existing. Treat that as a reason to prioritize remediation.

Remediation and mitigation

• Identify whether the MStore API plugin is installed on any WordPress site and confirm its version.
• If version 2.0.6 is in use and the plugin is not needed, remove or disable it.
• Monitor the VulnCheck advisory and the plugin page for vendor fix information.
• Where operationally possible, restrict access to the plugin's REST API routes and use web application firewall rules as a temporary compensating control.
• Where feasible, prevent the web server from executing PHP files in upload and configuration directories.

Detection guidance

• Review web server and application logs for unauthenticated POST requests to the plugin's REST API routes, particularly those referencing config_file.
• Look for unexpected PHP or other executable files in WordPress upload and plugin directories, and compare file lists against a known-good baseline.
• Investigate unexpected child processes or outbound connections originating from the web server process.

Limitations of the available information

• The record does not describe the exact vulnerable code path or the complete list of affected versions.
• No vendor fix is listed in the record.
• The CVSS scores are attributed to VulnCheck; no separate NVD scoring is included in the record.
• The EPSS date in the record (2026-10-13) should be verified against the source before it is relied upon.
• Whether the flaw is exploited in practice is not established by the sources consulted.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The record does list an exploit reference and a proof-of-concept exploitation rating, so prioritizing remediation is reasonable.

What should administrators do now?

Identify whether the MStore API plugin is installed, remove or disable it if it is not needed, restrict access to its REST routes, and check upload directories for unexpected PHP files. The record lists no fixed version, so monitor the plugin page and vendor advisories.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.