# CVE-2021-47933: WordPress MStore API arbitrary file upload in config_file endpoint

Source: https://junglewise.ai/threats/cve-2021-47933-wordpress-mstore-api-arbitrary-file-upload-in-config-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2021-47933 · Severity: critical · CVSS 9.8 · Published 2026-05-10

The MStore API plugin for WordPress, which allows businesses to convert their online stores into mobile apps, contains a critical security flaw. An unauthenticated attacker can upload malicious files directly to the web server without needing a password or special permissions. This could allow an attacker to take complete control of the website, potentially leading to the theft of customer data or a total service shutdown.

## Quick answers

**Is CVE-2021-47933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-47933 being exploited in the wild.

**How severe is CVE-2021-47933?** Critical severity, with a CVSS score of 9.8, published 10 May 2026.

**Which products and versions are affected?** FluxBuilder MStore API <= 2.0.6.

**Is there a fix for CVE-2021-47933?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-47933 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-47933?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MStore API plugin for WordPress (version 2.0.6 and likely earlier) suffers from an arbitrary file upload vulnerability due to missing authentication for critical functions (CWE-306). Specifically, the REST API endpoint `/wp-json/api/flutter_woo/config_file` does not properly validate or restrict file uploads. An unauthenticated remote attacker can send a specially crafted POST request containing a PHP file to this endpoint. Because the plugin allows arbitrary file names and types, the attacker can execute the uploaded script in the context of the web server, resulting in full remote code execution (RCE). While the vendor has released newer versions (up to 4.20.0), users should ensure they are running a version where this endpoint is secured or removed.

## Affected products

- FluxBuilder MStore API <= 2.0.6

## Timeline

- 2021-09-22: disclosed: Initial discovery and exploit development by researcher spacehen
- 2021-10-05: other: Exploit published on Exploit-DB
- 2026-05-10: advisory: CVE-2021-47933 published/updated via VulnCheck and NVD

## References

- [https://wordpress.org/plugins/mstore-api/](https://wordpress.org/plugins/mstore-api/)
- [https://www.exploit-db.com/exploits/50379](https://www.exploit-db.com/exploits/50379)
- [https://www.vulncheck.com/advisories/wordpress-mstore-api-arbitrary-file-upload](https://www.vulncheck.com/advisories/wordpress-mstore-api-arbitrary-file-upload)