PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-47933 WordPress CVE debrief

CVE-2021-47933 is a critical unauthenticated arbitrary file upload issue affecting the MStore API WordPress plugin, described as allowing attackers to POST malicious files to a REST API endpoint and potentially reach remote code execution on vulnerable servers. The supplied NVD record maps the issue to CWE-306, and the record’s references point to the plugin page plus external VulnCheck and Exploit-DB materials. Treat this as an immediate patch-and-audit item for any exposed installation of the affected plugin version.

Vendor
WordPress
Product
MStore API
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-10
Original CVE updated
2026-07-25
Advisory published
2026-05-10
Advisory updated
2026-07-25

Who should care

WordPress administrators, site owners, managed hosting providers, and incident responders responsible for sites using the MStore API plugin, especially environments running version 2.0.6 or otherwise exposed REST API endpoints.

Technical summary

The supplied CVE description states that MStore API 2.0.6 contains an arbitrary file upload vulnerability reachable by unauthenticated POST requests to a REST API endpoint. The record says attackers can upload PHP files with arbitrary names to the config_file endpoint, creating a path to remote code execution. The NVD source item classifies the weakness as CWE-306 (Missing Authentication for Critical Function) and rates the impact as network-exploitable with no privileges or user interaction required.

Defensive priority

Immediate

Recommended defensive actions

  • Identify whether the MStore API WordPress plugin is installed anywhere in your environment and confirm the exact version in use.
  • If version 2.0.6 is present or exposure cannot be ruled out quickly, disable or remove the plugin until a vendor fix is verified.
  • Restrict and monitor access to WordPress REST API endpoints, especially any endpoint related to file upload or configuration handling.
  • Review web server and application logs for unexpected uploads, new PHP files, or other signs of unauthorized content placement.
  • Validate server-side file upload controls and ensure executable file types cannot be written into web-accessible paths.
  • If compromise is suspected, isolate the host, collect forensic evidence, and rotate any credentials or secrets that may have been exposed on the server.

Evidence notes

This debrief is based on the supplied CVE description and the NVD source item published/modified on 2026-05-10. Supporting references in the corpus include the WordPress plugin page, a VulnCheck advisory, and an Exploit-DB entry. The supplied corpus does not include a fixed version or vendor remediation notice, so remediation guidance here is limited to containment and verification. The vendor field in the source data is low-confidence and needs review; the evidence most strongly indicates the MStore API WordPress plugin rather than WordPress core.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-47933 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-47933

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-47933 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-47933

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.