Description
WordPress Plugin MStore API的api/flutter_woo/config_file REST端点没有适当的授权(只检查插件是否有许可证)，也没有对请求中发送的配置文件进行足够的验证。因此，未经身份验证的用户可以使用这样的端点上传PHP文件，从而导致RCE
WordPress Plugin MStore API 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.vulncheck.com/advisories/wordpress-mstore-api-arbitrary-file-upload
https://www.exploit-db.com/exploits/50379
https://nvd.nist.gov/vuln/detail/CVE-2021-47933
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mstore-api/mstore-api-345-arbitrary-file-upload
https://github.com/advisories/GHSA-5c3p-jrjh-vwpm
https://cve.imfht.com/intel/602078