PT-2026-39509 · Unknown · Mstore Api

Spacehen · Published 2026-05-10 · Updated 2026-05-10 · CVE-2021-47933

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MStore API version 2.0.6

Description An arbitrary file upload flaw allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API. Specifically, attackers can upload PHP files with arbitrary names to the 'config file' endpoint to achieve remote code execution on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-47933

Affected Products

Mstore Api

References · 5

• 🔥 https://exploit-db.com/exploits/50379 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47933 · Security Note
• https://vulncheck.com/advisories/wordpress-mstore-api-arbitrary-file-upload · Note
• https://twitter.com/KaitanSecurity/status/2053467609622827150 · Twitter Post
• https://wordpress.org/plugins/mstore-api · Note