Unauthenticated Arbitrary File Upload Vulnerability in Amasty Order Attributes for Magento 2
CVE-2026-53787

9.3CRITICAL

Key Information:

Vendor

Amasty

Status
Order Attributes For Magento 2
Vendor
CVE Published:
12 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-53787?

Amasty Order Attributes for Magento 2 prior to version 4.0.0 is impacted by an unauthenticated arbitrary file upload vulnerability. This flaw allows attackers to upload files of any type to the store's media directory without requiring authentication or session validation. If the uploaded files include executable scripts, such as PHP files, this can lead to remote code execution on compromised servers where PHP execution is permitted in the media directory. Additionally, the vulnerability may allow for the hosting of malicious content, stored cross-site scripting via malicious HTML or SVG files, and potential path traversal to write files to unintended directories.

Affected Version(s)

Order Attributes for Magento 2 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-53787-poc
Created by MRdark-ops

References

https://sansec.io/research/amasty-order-attributes-file-u...
technical-description
https://amasty.com/order-attributes-for-magento-2.html
productrelease-notes
https://www.vulncheck.com/advisories/amasty-order-attribu...
third-party-advisory

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sansec
.