CVE-2021-47965CWE-434

WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload

Critical · published May 15, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00598 · 47.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-05-15T18:36Z
EPSS history
Timeline
  • 15 MAY 18:36Z
    WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload
    cvelistv5