PT-2026-41344 · WordPress · Wp Super Edit

H4Shur · Published 2026-05-15 · Updated 2026-05-17 · CVE-2021-47965

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Super Edit versions 2.5.4 and earlier

Description The FCKeditor component contains an unrestricted file upload flaw. Attackers can upload arbitrary and dangerous file types without validation through the 'filemanager upload' endpoint, which can lead to remote code execution and complete system compromise.

Recommendations Update to a version later than 2.5.4. As a temporary workaround, restrict access to the 'filemanager upload' endpoint to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-47965

Affected Products

Wp Super Edit

References · 6

• 🔥 https://exploit-db.com/exploits/49839 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47965 · Security Note
• https://vulncheck.com/advisories/wordpress-plugin-wp-super-edit-unrestricted-file-upload · Note
• https://wordpress.org · Note
• https://twitter.com/ThreatAft/status/2055976985260957795 · Twitter Post
• https://wordpress.org/plugins/wp-super-edit · Note