Authenticated Plugin Upload Enables Remote Code Execution

TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2021-47976 affects TextPattern CMS 4.9.0-dev and represents a critical post-authentication remote code execution vulnerability in the plugin upload mechanism. While the vulnerability requires initial authentication, it leverages a CSRF token retrieval flaw to allow attackers to bypass upload restrictions and place arbitrary PHP files in the web-accessible textpattern/tmp/ directory. This directly impacts organizations running vulnerable TextPattern instances, particularly those with multiple user accounts or where account compromise is feasible. The ability to execute arbitrary code on the server transforms a compromised user account into a full system compromise vector, making this a high-severity threat despite its authentication requirement.

Casky's 301 mapped skills detect this attack through Claude AI's analysis of two critical MITRE ATT&CK techniques: TA0001 (Initial Access) and TA0043 (Persistence). Practitioners using Casky would identify suspicious patterns including authenticated file upload requests to plugin directories with PHP file extensions, CSRF token manipulation attempts on plugin configuration pages, and unexpected executable files appearing in temporary directories. The platform's extended reasoning capabilities correlate upload attempts with subsequent web shell access patterns, helping teams recognize the attack chain from initial authentication through code execution. Security teams would see findings highlighting CWE-352 (Cross-Site Request Forgery) exploitation combined with arbitrary file upload, enabling faster detection and response to this specific attack pattern in their TextPattern deployments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2021-47976.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2021-47976

Casky has 301 skills that investigate the attack patterns behind CVE-2021-47976. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn