Security readout for executives and security teams
Plain-English summary
A WordPress plugin called MStore API (version 2.0.6) has a flaw that lets anyone on the internet upload files to a site without logging in. Attackers can drop malicious files that effectively give them control of the website and underlying server, putting customer data, payments, and brand trust at risk.
Executive priority
Treat as a top-priority patch for any WooCommerce/WordPress storefront using MStore API. A pre-auth remote code execution on a public site can lead to data theft, payment skimming, and full site takeover; remediate within the current patch cycle and accelerate if 2.0.6 is confirmed.
Technical view
CVE-2021-47933 is an unauthenticated arbitrary file upload (CWE-306, Missing Authentication) in WordPress MStore API plugin 2.0.6. A POST to the plugin's REST API config_file endpoint accepts attacker-supplied PHP files, enabling remote code execution. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Likely exposure
Any WordPress site running MStore API 2.0.6 with the REST API reachable from the internet is exposed. The plugin powers mobile commerce apps on WooCommerce stores, so e-commerce and customer-facing sites are the most likely victims.
Exploitation context
Public exploit code is available on Exploit-DB (entry 50379) and the issue is documented in a VulnCheck advisory. No KEV listing is cited in the bundle, so active in-the-wild exploitation is not confirmed here, but the low attack complexity and public PoC make opportunistic abuse highly plausible.
Researcher notes
CWE-306 indicates the REST route lacks an authentication/permission_callback check, allowing unauthenticated POSTs to write files. The config_file endpoint accepts attacker-controlled filenames, including .php, defeating extension filtering. Public PoC exists (EDB-50379); validate against 2.0.6 only and confirm fixed version via vendor changelog before declaring remediation complete.
Mitigation direction
- Inventory WordPress sites for MStore API plugin and identify any running version 2.0.6.
- Upgrade MStore API to the latest vendor-supported release per the WordPress.org plugin page.
- If an immediate upgrade is not possible, disable or remove the MStore API plugin.
- Restrict access to /wp-json/ REST API endpoints via WAF rules or IP allowlists where feasible.
- Scan webroot and uploads directories for unexpected PHP files and unknown admin users.
- Rotate WordPress, database, and API credentials on any host suspected of compromise.
Validation and detection
- Confirm installed plugin version from wp-admin Plugins page or wp-cli plugin list.
- Review web server access logs for POST requests to the MStore API config_file REST endpoint.
- Check uploads and plugin directories for recently created PHP files with unexpected names.
- Run a malware/web-shell scanner (e.g., Wordfence, host EDR) against the WordPress install.
- After patching, re-test the affected REST endpoint to confirm uploads are rejected.
- Validate fix using vendor changelog and the VulnCheck advisory for the fixed version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47933 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50379CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- VulnCheck Advisory: WordPress MStore API 2.0.6 Arbitrary File UploadCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.