CVE-2021-47940 Overview
CVE-2021-47940 is an arbitrary file upload vulnerability in the WordPress plugin Download From Files version 1.48 and earlier. The flaw allows unauthenticated attackers to upload arbitrary files, including PHP web shells, by abusing the plugin's AJAX upload handler. Attackers send crafted POST requests to admin-ajax.php targeting the download_from_files_617_fileupload action and manipulate the allowExt parameter to bypass file extension restrictions. Successful exploitation results in remote code execution on the affected WordPress server. The vulnerability is categorized under [CWE-306] Missing Authentication for Critical Function.
Critical Impact
Unauthenticated attackers can upload PHP shells to the web root and achieve remote code execution on affected WordPress installations.
Affected Products
- WordPress Plugin Download From Files version 1.48
- WordPress Plugin Download From Files versions prior to 1.48
- WordPress installations with the Download From Files plugin enabled
Discovery Timeline
- 2026-05-10 - CVE-2021-47940 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2021-47940
Vulnerability Analysis
The Download From Files plugin registers an AJAX action handler named download_from_files_617_fileupload that processes file uploads without authentication. The handler is exposed through the standard WordPress admin-ajax.php endpoint, which accepts unauthenticated POST requests by design when actions are registered with wp_ajax_nopriv_. This exposure allows any remote actor to invoke the upload routine.
The upload handler accepts a client-supplied allowExt parameter that defines the list of permitted file extensions. Because the server trusts this attacker-controlled value rather than enforcing a server-side allowlist, the file type restriction can be trivially bypassed. An attacker submits an extension such as php in allowExt and uploads a malicious script.
Uploaded files are written to a location reachable from the web root, enabling direct execution by requesting the resulting URL. The combination of missing authentication, client-controlled validation, and a web-accessible upload destination produces a reliable remote code execution primitive.
Root Cause
The root cause is missing authentication on a critical function combined with client-side trust of validation parameters. The AJAX action is registered for unauthenticated users, and the file extension allowlist is read from the request body instead of being hardcoded server-side.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends a multipart POST request to /wp-admin/admin-ajax.php with action=download_from_files_617_fileupload, allowExt=php, and a PHP payload as the uploaded file. The response typically includes the path to the stored shell, which the attacker then requests directly to execute arbitrary PHP code. Public exploit details are referenced in Exploit-DB #50287 and the VulnCheck Advisory for WordPress Plugin.
Detection Methods for CVE-2021-47940
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing the parameter action=download_from_files_617_fileupload from unauthenticated sources.
- Presence of unexpected .php, .phtml, or .phar files within the plugin upload directory or web root.
- Outbound network connections originating from the php or php-fpm worker process to attacker-controlled infrastructure following an upload event.
- Web server access logs showing direct GET requests to recently created files inside the plugin's upload path.
Detection Strategies
- Inspect web server logs for the download_from_files_617_fileupload action string combined with allowExt parameters containing executable extensions.
- Hash and baseline files under the WordPress wp-content/uploads/ and plugin directories, alerting on new server-executable file types.
- Deploy web application firewall rules that block AJAX requests carrying allowExt=php or similar executable extensions.
Monitoring Recommendations
- Forward Apache, Nginx, and PHP-FPM logs to a centralized analytics platform for correlation of upload attempts and subsequent shell access.
- Monitor file integrity on the WordPress installation directory and alert on newly created PHP files outside expected paths.
- Track child processes spawned by the web server user, such as sh, bash, python, or curl, which often indicate post-exploitation activity following a successful upload.
How to Mitigate CVE-2021-47940
Immediate Actions Required
- Deactivate and remove the Download From Files plugin from any WordPress site where it is installed, as no patched version is referenced in the advisory.
- Audit the wp-content/uploads/ directory and plugin folders for unauthorized PHP files and remove any web shells discovered.
- Rotate WordPress administrator credentials, secret keys in wp-config.php, and any database or API credentials that may have been exposed.
- Review web server access logs for prior exploitation attempts referencing the vulnerable AJAX action.
Patch Information
No vendor patch is referenced in the available advisory data. The WordPress Plugin Download Resource page should be consulted for the current plugin status. Until a fixed release is confirmed, removing the plugin is the recommended remediation. Additional technical context is available in the VulnCheck Advisory for WordPress Plugin.
Workarounds
- Block requests to admin-ajax.php containing action=download_from_files_617_fileupload at the web application firewall or reverse proxy.
- Disable PHP execution within the wp-content/uploads/ directory using web server configuration to neutralize uploaded shells.
- Restrict access to /wp-admin/admin-ajax.php to authenticated sessions where business requirements permit.
# Nginx configuration to disable PHP execution in WordPress uploads directory
location ~* /wp-content/uploads/.*\.php$ {
deny all;
return 403;
}
# WAF rule pattern to block the vulnerable AJAX action
# SecRule ARGS:action "@streq download_from_files_617_fileupload" \
# "id:1004794,phase:2,deny,status:403,log,msg:'CVE-2021-47940 exploit attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
