EUVD-2026-58837
GHSA-mq3w-pgpp-67hx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE description explicitly states unauthenticated exploitation, overriding the supplied PR:L; low complexity upload bypass with full system impact warrants C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The MaxUpload - Big File Uploads - Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handle_upload function. This is due to a filename-validation mismatch in the handle_upload function where extension and MIME checks are applied to the uploaded chunk's filename but not to the final assembled filename derived from the resumableFilename parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
AnalysisAI
Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The MaxUpload plugin must be installed and activated on the target WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | There is a notable conflict in the provided data: the CVE description explicitly states 'unauthenticated attackers' can exploit this, while the supplied CVSS 3.1 vector specifies PR:L (low-privilege required). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been identified at the time of this analysis - no fixed release tag or advisory patch version is referenced in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable and remove the MaxUpload plugin from all affected WordPress instances; if immediate removal is not operationally feasible, configure the web server to prevent PHP execution within upload directories (Apache: add appropriate .htaccess directives; nginx: add location-block rules). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today