CVE-2021-47965: WP Super Edit File Upload RCE Vulnerability

CVE-2021-47965 Overview

CVE-2021-47965 is an unrestricted file upload vulnerability in the WordPress Plugin WP Super Edit version 2.5.4 and earlier. The flaw resides in the bundled FCKeditor component, which accepts file uploads through the filemanager upload endpoint without validating file types or extensions. Attackers can upload arbitrary executable files, including PHP web shells, to the WordPress server. Successful exploitation leads to remote code execution under the web server context and full site compromise. The vulnerability is categorized as improper restriction of dangerous file uploads [CWE-434] and is reachable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can upload PHP web shells through the FCKeditor filemanager endpoint and execute arbitrary code on affected WordPress sites.

Affected Products

WordPress Plugin WP Super Edit 2.5.4
WordPress Plugin WP Super Edit versions prior to 2.5.4
Any WordPress installation with the WP Super Edit plugin enabled

Discovery Timeline

2026-05-15 - CVE-2021-47965 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2021-47965

Vulnerability Analysis

The WP Super Edit plugin integrates the legacy FCKeditor rich-text editor into WordPress to extend the default visual editor. FCKeditor ships with a built-in file manager that exposes upload connector scripts to handle media uploads from the editor toolbar. In WP Super Edit 2.5.4 and earlier, these connector endpoints are deployed without enforcing extension allowlists, MIME type checks, or authentication controls.

Attackers can submit a multipart POST request to the FCKeditor upload connector and place a .php file inside the WordPress uploads directory. Because the file lands under a web-accessible path served by the Apache or PHP-FPM handler, requesting the uploaded file executes the embedded PHP payload. This grants the attacker an interactive web shell running with the privileges of the WordPress process.

The vulnerability requires no credentials, no user interaction, and is exploitable purely over HTTP. Public exploitation details are documented in Exploit-DB #49839 and the VulnCheck Advisory for WP Super Edit.

Root Cause

The root cause is the absence of server-side validation in the FCKeditor file manager connector bundled with WP Super Edit. The upload handler accepts any file extension and writes the file directly to a public directory under wp-content, with no allowlist, no content inspection, and no authentication check.

Attack Vector

The attack vector is a single HTTP POST request to the FCKeditor filemanager upload connector, typically located under the plugin's path inside wp-content/plugins/wp-super-edit/. The attacker submits a file with a PHP extension and then requests it through its public URL to trigger execution. No WordPress account or session is required.

For technical details and a working proof-of-concept, see the Exploit-DB #49839 entry.

Detection Methods for CVE-2021-47965

Indicators of Compromise

POST requests to FCKeditor filemanager/connectors/ or editor/filemanager/ paths under wp-content/plugins/wp-super-edit/.
Newly created .php, .phtml, or .phar files inside wp-content/uploads/ or plugin upload directories.
Outbound connections from the web server process to attacker-controlled infrastructure after suspicious uploads.
Web server log entries showing GET requests directly fetching PHP files from upload directories.

Detection Strategies

Inspect HTTP access logs for upload requests targeting FCKeditor connector endpoints associated with WP Super Edit.
Run file integrity monitoring across wp-content/uploads/ and plugin directories to identify unexpected PHP files.
Alert on web server processes (php-fpm, apache2, httpd, nginx) spawning shells or executing reconnaissance commands.

Monitoring Recommendations

Forward WordPress, web server, and host telemetry into a centralized data lake for correlation across upload activity and subsequent process execution.
Track creation of executable file types within any web-accessible directory and trigger alerts on first occurrence.
Monitor for known WP Super Edit plugin paths in inbound traffic, especially from unauthenticated sessions.

How to Mitigate CVE-2021-47965

Immediate Actions Required

Disable or uninstall the WP Super Edit plugin from all WordPress installations until a patched version is verified.
Audit wp-content/uploads/ and plugin directories for unauthorized PHP files and remove any web shells discovered.
Rotate WordPress administrator credentials, API keys, and database passwords if compromise is suspected.
Block access to FCKeditor filemanager connector paths at the web application firewall or reverse proxy layer.

Patch Information

No vendor patch is referenced in the available advisories. The WP Super Edit plugin is no longer actively maintained on the official WP Super Edit Plugin Page. Administrators should remove the plugin and migrate to a supported editor extension. Refer to the VulnCheck Advisory for WP Super Edit for the latest remediation guidance.

Workarounds

Deny HTTP access to wp-content/plugins/wp-super-edit/ at the web server configuration level.
Configure the web server to refuse execution of PHP files under wp-content/uploads/ and other writable directories.
Deploy a WAF rule that blocks multipart uploads containing PHP file extensions to FCKeditor connector URLs.

bash

# Apache: prevent PHP execution inside the WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>

# Nginx: deny execution of PHP under uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}

# Block direct access to the vulnerable plugin path
location ~* /wp-content/plugins/wp-super-edit/ {
    deny all;
    return 403;
}