Quick Look: CVE-2021-47940 — Unauthenticated Arbitrary File Upload in WordPress Download From Files Plugin

Introduction

An abandoned WordPress plugin with no prospect of a patch still exposes sites to unauthenticated remote code execution through a file upload flaw that is trivial to exploit. CVE-2021-47940 affects the "Download From Files" plugin, versions 1.48 and earlier, and carries a CVSS score of 9.8.

The Download From Files plugin was a small WordPress extension that let site administrators offer file downloads to visitors. Its footprint was limited, with WPScan reporting roughly 100 active installations, and it was maintained by an anonymous contributor listed as "Anonymous User 17720058." The plugin was permanently closed on the WordPress.org repository on September 15, 2021 over a security issue, and it has not been updated in over five years.

Technical Information

This vulnerability comes down to a missing authentication check on a WordPress AJAX action handler. The plugin registers an action called download_from_files_617_fileupload that processes file uploads through the standard WordPress AJAX endpoint at /wp-admin/admin-ajax.php. That action is reachable by unauthenticated users, so no WordPress session or nonce is required to invoke it. This falls under CWE-306: Missing Authentication for Critical Function.

The more damaging design flaw is that the handler lets the caller control which file extensions are accepted for upload. The allowExt parameter, submitted as part of the multipart form data, is trusted without server side validation. An attacker can set it to any executable extension, such as php4 or phtml, which bypasses any intended file type restrictions.

Attack Flow

The exploitation sequence runs as follows:

1. The attacker sends a GET request to /wp-admin/admin-ajax.php?action=download_from_files_617_fileupload to confirm the plugin is active. A response containing the Hungarian word "Sikeres" (meaning "Successful") confirms the endpoint is reachable.

2. The attacker crafts a POST request to the same endpoint with multipart/form-data content type. The POST body includes:

   • allowExt set to an executable extension (e.g., php4 or phtml)
   • uploadDir set to . (resolving to the current directory, which is wp-admin/)
   • filesName set to files
   • A files[] field containing the malicious PHP payload (e.g., a web shell)

3. The server processes the upload and writes the file to the wp-admin/ directory.

4. The attacker accesses the uploaded shell directly at a predictable URL such as https://example.com/wp-admin/a.php4, achieving remote code execution on the server.

The whole chain requires no authentication, no privilege escalation, and no complex technique. It is a single HTTP request that results in arbitrary code execution on the target server.

Detection Methods

Identifying Vulnerable Installations

The plugin slug is download-from-files, and its files live under /wp-content/plugins/download-from-files/. Since the plugin has been removed from the WordPress.org repository and remains unpatched, any installation that still has it is vulnerable. The public exploit also provides a Google Dork (inurl:/wp-content/plugins/download-from-files) for external attack surface enumeration to find exposed instances.

Network Level Detection (HTTP Request Patterns)

The exploit relies on a POST request to the WordPress AJAX handler. Defenders should monitor web server access logs and WAF logs for requests matching this pattern:

• Target URI: /wp-admin/admin-ajax.php with the query parameter action=download_from_files_617_fileupload
• HTTP Method: POST with a multipart/form-data content type (indicating file upload)
• Suspicious POST body parameters: The allowExt field set to executable extensions such as php4, phtml, php, or similar; the uploadDir parameter set to . (current directory); and a files[] field carrying the uploaded payload

Any HTTP request containing download_from_files_617_fileupload as the AJAX action strongly indicates either exploitation or reconnaissance, because this action name is unique to the vulnerable plugin. You can configure WAF rules or proxy level inspection rules to flag or block requests where the action parameter matches this string.

The public exploit also runs a preliminary vulnerability check through a GET request to the same endpoint. The response contains the Hungarian word "Sikeres" when the plugin is active and the endpoint is reachable. GET requests to this endpoint followed by POST requests with file uploads are a clear exploitation workflow.

Host Level Detection (File System Monitoring)

After a successful exploit, the attacker's uploaded file (typically a PHP web shell with a .php4 or .phtml extension) is written to the WordPress /wp-admin/ directory. Configure file integrity monitoring (FIM) solutions to alert on the creation of new files in the wp-admin/ directory, especially those with executable PHP related extensions (.php, .php4, .phtml, .php5, .phar). Treat any PHP file in wp-admin/ that is not part of the standard WordPress core distribution as highly suspicious.

Log Based Indicators of Compromise

In your web server logs (Apache access.log, Nginx access.log), look for:

• Entries with the URI path containing admin-ajax.php?action=download_from_files_617_fileupload, especially from unauthenticated sessions (no WordPress auth cookies present)
• Subsequent requests to unexpected PHP files in the /wp-admin/ directory that do not correspond to known WordPress core files, which indicate the attacker is accessing their uploaded shell

WordPress Security Scanners

Both WPScan (WVDB ID 8defc276-c5b0-447e-87d4-01c285051a6e) and Wordfence Intelligence track this vulnerability. Running WPScan against your WordPress sites or using the Wordfence plugin will flag the presence of the vulnerable download-from-files plugin. You can also query the Wordfence Intelligence API programmatically to check for this specific plugin vulnerability.

No publicly available IDS/IPS signatures (Snort, Suricata), YARA rules, or Sigma rules specifically tailored for CVE-2021-47940 were identified at the time of writing. The distinctive AJAX action string download_from_files_617_fileupload is unique enough that custom detection rules targeting it in HTTP traffic would give high fidelity alerting with minimal false positives.

Affected Systems and Versions

• Plugin: Download From Files for WordPress
• Affected Versions: Version 1.48 and all earlier versions
• Platform: Any WordPress installation with the Download From Files plugin installed and active
• Last Tested WordPress Version: 5.8.13
• Plugin Status: Permanently closed on the WordPress.org repository as of September 15, 2021; no fix will be released

Vendor Security History

The Download From Files plugin was maintained by an anonymous contributor ("Anonymous User 17720058") with no public identity or track record. It had not been updated in over five years before its closure and was only tested up to WordPress 5.8.13. The permanent closure over a security issue, the anonymous maintainership, and the prolonged neglect together point to a project with no meaningful security maintenance lifecycle. With only about 100 active installations reported by WPScan, the plugin had a minimal market footprint, but the severity of this vulnerability (CVSS 9.8, unauthenticated RCE) makes it a critical concern for any remaining installations.

References

• NVD: CVE-2021-47940
• WordPress.org Plugin Page: Download From Files
• ExploitDB: WordPress Plugin Download From Files 1.48 Arbitrary File Upload (EDB-50287)
• VulnCheck Advisory: WordPress Download From Files 1.48 Arbitrary File Upload
• WPScan Vulnerability Entry: Unauthenticated Arbitrary File Upload
• WPScan Plugin Page: Download From Files
• Wordfence Intelligence: Download From Files
• Archived WordPress.org Plugin Page (September 2021)