# CVE-2021-47940: WordPress Download From Files arbitrary file upload in AJAX handler

Source: https://junglewise.ai/threats/cve-2021-47940-wordpress-download-from-files-arbitrary-file-upload-in-ajax  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2021-47940 · Severity: critical · CVSS 9.8 · Published 2026-05-10

The Download From Files plugin for WordPress, which allows users to manage and serve documents from a website's filesystem, contains a critical security flaw. An unauthenticated attacker can upload malicious files, such as web shells, directly to the server. This could lead to a complete takeover of the website, theft of sensitive data, or the installation of ransomware.

## Quick answers

**Is CVE-2021-47940 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-47940 being exploited in the wild.

**How severe is CVE-2021-47940?** Critical severity, with a CVSS score of 9.8, published 10 May 2026.

**Which products and versions are affected?** WordPress Plugin Download From Files Download From Files <= 1.48.

**Is there a fix for CVE-2021-47940?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-47940 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-47940?** Check whether you run WordPress Plugin Download From Files Download From Files at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An arbitrary file upload vulnerability exists in the 'Download From Files' WordPress plugin due to missing authentication and insufficient validation in its AJAX file upload handler. Attackers can send unauthenticated POST requests to the 'admin-ajax.php' endpoint using the 'download_from_files_617_fileupload' action. By manipulating the 'allowExt' parameter, an attacker can bypass intended file extension restrictions and upload executable PHP files (e.g., .php4 or .phtml) directly to the web root. This allows for remote code execution (RCE) on the underlying server. The plugin has been permanently closed on the WordPress repository due to this issue.

## Affected products

- WordPress Plugin Download From Files <= 1.48

## Timeline

- 2021-09-10: disclosed: Initial exploit discovery by researcher spacehen
- 2021-09-13: other: Exploit published on Exploit-DB
- 2021-09-15: other: Plugin permanently closed on WordPress.org repository
- 2026-05-10: advisory: CVE published/updated via VulnCheck/NVD

## References

- [https://wordpress.org/plugins/download-from-files/](https://wordpress.org/plugins/download-from-files/)
- [https://www.exploit-db.com/exploits/50287](https://www.exploit-db.com/exploits/50287)
- [https://www.vulncheck.com/advisories/wordpress-download-from-files-arbitrary-file-upload](https://www.vulncheck.com/advisories/wordpress-download-from-files-arbitrary-file-upload)