MStore API, CVE-2021-47933

CVE, Research URL: CVE-2021-47933
Home page URL: Security reports for MStore API
Application: MStore API
Published on: May 10, 2026
Research Description: WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.
Affected versions: max 2.0.6.
Status: vulnerable