CVE-2021-47940
WordPress Plugin Download From Files versions 1.48 and earlier allow attackers to upload arbitrary files without authentication. By sending a crafted POST request to the plugin’s AJAX endpoint, an attacker can bypass file type checks and place executable files such as PHP shells on the web server. This flaw can lead to full control over the affected site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress Plugin Download From Files, versions 1.48 and earlier.
Real-world impact
An attacker can upload malicious files to the web root, enabling them to run arbitrary code on the server, steal data, or take the site offline.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability is exploitable remotely without authentication, has a high impact on confidentiality, integrity, and availability, and offers attackers the ability to execute code with full privileges.
What to do about it
- ›Disable or uninstall the Download From Files plugin until a patched version is released.
- ›If the plugin must remain, restrict file uploads to safe types and monitor the web root for unauthorized files.
- ›Apply general WordPress security best practices, such as keeping core and plugins up to date and limiting file upload permissions.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 10, 2026 · May 10, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 25, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.