Executive brief
MaxUpload is a WordPress plugin that allows sites to accept large file uploads from visitors. The plugin contains a critical flaw that allows attackers to upload executable files without authentication, enabling them to run malicious code on the web server and compromise the site.
Technical details
The vulnerability is an arbitrary file upload flaw in the handle_upload function of the MaxUpload plugin. The vulnerable code applies filename extension and MIME-type validation to individual uploaded chunks, but fails to apply the same checks to the final assembled filename derived from the resumableFilename parameter. This validation mismatch allows an unauthenticated attacker to bypass file-type restrictions by manipulating the resumableFilename parameter to specify an executable file extension (e.g., .php). The attacker needs only network access to the upload endpoint; no authentication or user interaction is required. Successful exploitation results in arbitrary code execution on the web server with the privileges of the web process.
Affected products
- WordPress MaxUpload up to and including 1.4.0
Timeline
- 2026-08-15: disclosed