Executive brief
The MStore API plugin for WordPress, which allows businesses to convert their online stores into mobile apps, contains a critical security flaw. An unauthenticated attacker can upload malicious files directly to the web server without needing a password or special permissions. This could allow an attacker to take complete control of the website, potentially leading to the theft of customer data or a total service shutdown.
Technical details
The MStore API plugin for WordPress (version 2.0.6 and likely earlier) suffers from an arbitrary file upload vulnerability due to missing authentication for critical functions (CWE-306). Specifically, the REST API endpoint `/wp-json/api/flutter_woo/config_file` does not properly validate or restrict file uploads. An unauthenticated remote attacker can send a specially crafted POST request containing a PHP file to this endpoint. Because the plugin allows arbitrary file names and types, the attacker can execute the uploaded script in the context of the web server, resulting in full remote code execution (RCE). While the vendor has released newer versions (up to 4.20.0), users should ensure they are running a version where this endpoint is secured or removed.
Affected products
- FluxBuilder MStore API <= 2.0.6
Timeline
- 2021-09-22: disclosed: Initial discovery and exploit development by researcher spacehen
- 2021-10-05: other: Exploit published on Exploit-DB
- 2026-05-10: advisory: CVE-2021-47933 published/updated via VulnCheck and NVD