WordPress Plugin Vulnerabilities

WP Super Edit <= 2.5.4 - Unauthenticated Arbitrary File Upload

Description

The WP Super Edit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.5.4. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
wp-super-edit
No known fix

References

CVE
CVE-2021-47965
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a6dde21f-f747-4a80-a5eb-c4af847fbfc7

Miscellaneous

Original Researcher
h4shur
Verified
No
WPVDB ID
d7900aaf-6604-4fde-882c-29e46c093259

Timeline

Publicly Published
2026-05-15 (about 4 months ago)
Added
2026-07-29 (about 1 month ago)
Last Updated
2026-07-29 (about 1 month ago)

Other

Published
Title
Published
2024-10-30
Title
Multi Purpose Mail Form <= 1.0.2 - Unauthenticated Arbitrary File Upload
Published
2026-04-06
Title
Ninja Forms - File Upload < 3.3.27 - Unauthenticated Arbitrary File Upload
Published
2023-12-04
Title
Piotnet Forms < 1.0.29 - Unauthenticated Arbitrary File Upload
Published
2025-12-04
Title
Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload
Published
2025-06-09
Title
Abandoned Cart Pro for WooCommerce < 9.17.0 - Authenticated (Subscriber+) Arbitrary File Upload