CVE-2021-47940 | WordPress Plugin Download From Files version 1.48 and earlie… | CVSS 9.8 CRITICAL

Description

WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX fileupload action. Attackers can send POST requests to the admin-ajax.php endpoint with the download_from_files_617_fileupload action, manipulating the allowExt parameter to bypass file type restrictions and upload executable files like PHP shells to the web root.

Metadata

CVE ID: CVE-2021-47940
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-01 11:24 UTC
Published: 2026-05-10 12:43 UTC
Last updated: 2026-05-11 13:23 UTC
Primary CWE: CWE-306
Missing Authentication for Critical Function
Vendor / Product: download-from-files / Download From Files
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
download-from-files	Download From Files	—	0 ≤ 1.48

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	Missing Authentication for Critical Function

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-50287 https://www.exploit-db.com/exploits/50287
Official Product Homepage https://wordpress.org/plugins/download-from-files/
VulnCheck Advisory: WordPress Download From Files 1.48 Arbitrary File Upload https://www.vulncheck.com/advisories/wordpress-download-from-files-arbitrary-file-upload