CVE Intelligence
Analysis AI-assisted

CVE-2021-47940: WordPress Download From Files Plugin Unauthenticated Arbitrary File Upload

CVE-2021-47940 affects the Download From Files plugin for WordPress, version 1.48 and earlier, and allows unauthenticated users to upload arbitrary files according to the record description. The CNA VulnCheck assigns a score of 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, and the record classifies the issue as CWE-306. CISA KEV does not list it, and no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2021-47940 is an arbitrary file upload flaw in the Download From Files plugin for WordPress. The record classifies it under CWE-306 (Missing Authentication for Critical Function), meaning a sensitive function can be reached without adequate authentication checks.

Impact

  • According to the description, an unauthenticated remote attacker could place executable files, such as PHP scripts, in the web root.
  • Uploaded server-side scripts could enable remote code execution, data theft or site takeover. This is an inference based on the file upload description and the CVSS 3.1 impact ratings, which are high for confidentiality, integrity and availability.
  • VulnCheck scores are 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0).

Affected products and versions

  • Product: Download From Files plugin for WordPress.
  • Versions: 1.48 and earlier, according to the description.
  • The record's affected list is empty, so affected ranges beyond the description are unknown.
  • Fixed version: not present in the record. Check the plugin page on WordPress.org and the vendor changelog.

Exploitation status

  • CISA KEV: not listed in the record.
  • No confirmed active exploitation appears in the sources consulted.
  • A public exploit entry is referenced on Exploit-DB. Its presence does not establish that the flaw is exploited in the wild.

Remediation and mitigation

  • Identify all sites running the plugin and verify the installed version.
  • Update the plugin when a fixed version is confirmed. If no fix can be verified, consider removing or disabling the plugin.
  • Prevent script execution in upload directories at the web server level as defense in depth.
  • Restrict access to admin-ajax.php where feasible and review file type validation controls.
  • Review the web root for unexpected executable files and rotate credentials if compromise is suspected.

Detection guidance

  • Monitor web server logs for unusual POST requests to admin-ajax.php from unauthenticated clients.
  • Alert on new or modified script files in upload and web root directories.
  • Review file integrity baselines and web application firewall events for upload anomalies.

Limitations of the available information

  • The record has source_status Deferred and provides no additional CNA or NVD analysis beyond the listed scores.
  • No fixed version, vendor-confirmed affected range or patch details are present.
  • The published date (2026-05-10) and EPSS date (2026-10-13) are reported as recorded and were not independently verified.
  • The record title is null, so the title shown here is derived from the description.

Frequently asked questions

Is CVE-2021-47940 being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. A public exploit entry is referenced, but that alone does not confirm exploitation in the wild.

Which versions are affected?

According to the description, version 1.48 and earlier are affected. The record does not provide a fixed version, so check the plugin page and vendor changelog.

What should administrators do now?

Verify the installed plugin version, update when a fix is confirmed or remove the plugin if no fix can be verified, and prevent script execution in upload directories.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.