CVE-2026-27067
Published: 19 March 2026
Summary
CVE-2026-27067 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27067 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Syarif Mobile App Editor WordPress plugin (mobile-app-editor). It allows attackers to upload a web shell to a web server and affects all versions from n/a through 1.3.1. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and high impact across confidentiality, integrity, and availability with changed scope.
Exploitation requires high privileges (PR:H), such as those held by authenticated WordPress administrators or equivalent roles, with no user interaction needed. An attacker can leverage the flaw over the network to upload malicious files, including web shells, enabling remote code execution on the server. This grants high-impact control, potentially leading to full server compromise, data exfiltration, persistence, or lateral movement within the environment.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mobile-app-editor/vulnerability/wordpress-mobile-app-editor-plugin-1-3-1-arbitrary-file-upload-vulnerability?_s_id=cve documents the arbitrary file upload issue in Mobile App Editor plugin version 1.3.1, providing details for WordPress site owners to assess and address exposure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13087
Vulnerability details
Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through <= 1.3.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in public-facing WordPress plugin directly enables web shell deployment for RCE (T1100/T1505.003) via exploitation of the vulnerable application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unrestricted file upload vulnerability in the Mobile App Editor plugin by identifying, prioritizing, and applying patches or removing the affected component.
Validates uploaded files for type, content, and semantics to block dangerous files like web shells, directly countering the CWE-434 unrestricted upload flaw.
Deploys malicious code protection mechanisms to scan, detect, and prevent execution of web shells uploaded via the vulnerable plugin.