CVE-2021-47965 | WordPress Plugin WP Super Edit 2.5.4 and earlier contains an… | CVSS 9.8 CRITICAL

Description

WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise.

Metadata

CVE ID: CVE-2021-47965
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-05-15 16:35 UTC
Published: 2026-05-15 18:36 UTC
Last updated: 2026-05-25 23:41 UTC
Primary CWE: CWE-434
Unrestricted Upload of File with Dangerous Type
Vendor / Product: wp-super-edit / WP Super Edit
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
wp-super-edit	WP Super Edit	—	0 ≤ 2.5.4

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	Unrestricted Upload of File with Dangerous Type

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (4)

ExploitDB-49839 https://www.exploit-db.com/exploits/49839
Official Product Homepage https://wordpress.org
Product Reference https://wordpress.org/plugins/wp-super-edit/
VulnCheck Advisory: WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload https://www.vulncheck.com/advisories/wordpress-plugin-wp-super-edit-unrestricted-file-upload