CVE Intelligence
Analysis AI-assisted

CVE-2021-47965: WP Super Edit WordPress Plugin 2.5.4 - Unrestricted File Upload

WP Super Edit for WordPress, versions 2.5.4 and earlier, contains an unrestricted file upload weakness in its FCKeditor component (CWE-434). The record links it to possible remote code execution, with a VulnCheck CVSS 3.1 base score of 9.8. No CISA KEV listing or confirmed exploitation appears in the sources consulted, and no fixed version is recorded.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

WP Super Edit is a WordPress plugin. According to the record, versions 2.5.4 and earlier include an unrestricted file upload weakness in the FCKeditor component, classified as CWE-434. The description states that the upload endpoint of the filemanager accepts dangerous file types without validation.

Impact

  • The record states that the weakness can lead to remote code execution and complete system compromise.
  • VulnCheck provides a CVSS 3.1 base score of 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 9.3.
  • The SSVC fields in the record mark technical impact as total and automatable as yes.

Affected products and versions

  • Product: WP Super Edit (WordPress plugin), versions 2.5.4 and earlier, according to the record.
  • No fixed version is listed in the record. This does not prove that no fix exists; it means the available data does not identify one.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record (kev.listed is false), so active exploitation is not confirmed by that source.
  • No confirmed exploitation appears in the sources consulted.
  • The record references an Exploit-DB entry and gives an SSVC exploitation value of poc, which indicates that proof-of-concept material is publicly referenced. The EPSS probability is 0.00598 with a percentile of 0.47197.

Remediation and mitigation

  • Inventory all WordPress sites that run WP Super Edit and confirm the installed version.
  • Check the WordPress.org plugin page and the VulnCheck advisory for updates or vendor guidance.
  • If the plugin is not required, remove it.
  • Restrict file upload capabilities to trusted roles and disable the FCKeditor file manager functionality where it is not needed.
  • Keep WordPress core and other plugins up to date, and apply the principle of least privilege to the web server account.

Detection guidance

  • Review web server logs for unusual requests to the plugin's upload endpoints.
  • Monitor writable web directories for newly created script-type files that were not deployed through normal processes.
  • Compare file integrity baselines of WordPress directories against known-good states.

Limitations of the available information

  • The record contains no fixed version and no vendor statement about remediation.
  • The CVSS 3.1 and 4.0 values are the ones recorded by VulnCheck; the record does not include an NVD score.
  • The EPSS date in the record is later than the publication date, so the scoring data should be re-checked against live sources before decisions are made.
  • Technical details of the vulnerable endpoint are limited to the high-level description and are not provided here.

Frequently asked questions

Which versions of WP Super Edit are affected?

The record lists WP Super Edit versions 2.5.4 and earlier as affected. No fixed version is provided in the record.

Is this vulnerability confirmed as actively exploited?

No. The CISA KEV catalog does not list it in this record, and no confirmed exploitation appears in the sources consulted. The record does reference a public exploit entry and an SSVC exploitation value of poc.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.