CVE-2026-27067
Published: 19 March 2026
Summary
CVE-2026-27067 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the unrestricted file upload vulnerability in the Mobile App Editor plugin by identifying, prioritizing, and applying patches or removing the affected component.
Validates uploaded files for type, content, and semantics to block dangerous files like web shells, directly countering the CWE-434 unrestricted upload flaw.
Deploys malicious code protection mechanisms to scan, detect, and prevent execution of web shells uploaded via the vulnerable plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in public-facing WordPress plugin directly enables web shell deployment for RCE (T1100/T1505.003) via exploitation of the vulnerable application (T1190).
NVD Description
Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through <= 1.3.1.
Deeper analysisAI
CVE-2026-27067 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Syarif Mobile App Editor WordPress plugin (mobile-app-editor). It allows attackers to upload a web shell to a web server and affects all versions from n/a through 1.3.1. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and high impact across confidentiality, integrity, and availability with changed scope.
Exploitation requires high privileges (PR:H), such as those held by authenticated WordPress administrators or equivalent roles, with no user interaction needed. An attacker can leverage the flaw over the network to upload malicious files, including web shells, enabling remote code execution on the server. This grants high-impact control, potentially leading to full server compromise, data exfiltration, persistence, or lateral movement within the environment.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mobile-app-editor/vulnerability/wordpress-mobile-app-editor-plugin-1-3-1-arbitrary-file-upload-vulnerability?_s_id=cve documents the arbitrary file upload issue in Mobile App Editor plugin version 1.3.1, providing details for WordPress site owners to assess and address exposure.
Details
- CWE(s)