Cyber Posture

CVE-2026-27067

Critical

Published: 19 March 2026

Published
19 March 2026
Modified
23 April 2026
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0006 17.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27067 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the unrestricted file upload vulnerability in the Mobile App Editor plugin by identifying, prioritizing, and applying patches or removing the affected component.

prevent

Validates uploaded files for type, content, and semantics to block dangerous files like web shells, directly countering the CWE-434 unrestricted upload flaw.

preventdetect

Deploys malicious code protection mechanisms to scan, detect, and prevent execution of web shells uploaded via the vulnerable plugin.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1100 Web Shell Persistence
A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Unrestricted file upload (CWE-434) in public-facing WordPress plugin directly enables web shell deployment for RCE (T1100/T1505.003) via exploitation of the vulnerable application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through <= 1.3.1.

Deeper analysisAI

CVE-2026-27067 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Syarif Mobile App Editor WordPress plugin (mobile-app-editor). It allows attackers to upload a web shell to a web server and affects all versions from n/a through 1.3.1. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and high impact across confidentiality, integrity, and availability with changed scope.

Exploitation requires high privileges (PR:H), such as those held by authenticated WordPress administrators or equivalent roles, with no user interaction needed. An attacker can leverage the flaw over the network to upload malicious files, including web shells, enabling remote code execution on the server. This grants high-impact control, potentially leading to full server compromise, data exfiltration, persistence, or lateral movement within the environment.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mobile-app-editor/vulnerability/wordpress-mobile-app-editor-plugin-1-3-1-arbitrary-file-upload-vulnerability?_s_id=cve documents the arbitrary file upload issue in Mobile App Editor plugin version 1.3.1, providing details for WordPress site owners to assess and address exposure.

Details

CWE(s)

CVEs Like This One

CVE-2025-67924Shared CWE-434
CVE-2026-38526Shared CWE-434
CVE-2025-62056Shared CWE-434
CVE-2025-6057Shared CWE-434
CVE-2020-36942Shared CWE-434
CVE-2024-57169Shared CWE-434
CVE-2023-53933Shared CWE-434
CVE-2025-68909Shared CWE-434
CVE-2021-47757Shared CWE-434
CVE-2025-68986Shared CWE-434

References