What is the CVSS score of EUVD-2026-58837?

EUVD-2026-58837 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of MaxUpload WordPress Plugin are affected by EUVD-2026-58837?

The MaxUpload WordPress plugin (versions through 1.4.0) contains a vulnerability enabling unauthenticated remote code execution through arbitrary file upload.

How to fix or mitigate EUVD-2026-58837?

Within 24 hours, disable and remove the MaxUpload plugin from all affected WordPress instances; if immediate removal is not operationally feasible, configure the web server to prevent PHP execution within upload directories (Apache: add appropriate .htaccess directives; nginx: add location-block rules). Within 7 days, audit application and web server logs for evidence of exploitation, and conduct file integrity checks across upload directories for suspicious files. Within 30 days, implement a plugin update monitoring process and prepare to deploy a patched version or approved alternative as soon as the vendor releases a security update.

MaxUpload WordPress Plugin EUVD-2026-58837

| CVE-2026-15965 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-15 Wordfence

GHSA-mq3w-pgpp-67hx

WordPress RCE File Upload Wordpress Plugin Maxupload Big File Uploads Increase Maximum File Upload Size

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

CVE description explicitly states unauthenticated exploitation, overriding the supplied PR:L; low complexity upload bypass with full system impact warrants C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 03:00 vuln.today

CVE Published

Aug 15, 2026 - 02:26 cve.org

HIGH 8.8

DescriptionCVE.org

The MaxUpload - Big File Uploads - Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handle_upload function. This is due to a filename-validation mismatch in the handle_upload function where extension and MIME checks are applied to the uploaded chunk's filename but not to the final assembled filename derived from the resumableFilename parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

AnalysisAI

Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. No public exploit is confirmed, but the vulnerability is straightforward to exploit against any WordPress site with the plugin active and PHP execution permitted in the upload directory, making it a high-priority remediation target.

Technical ContextAI

The affected plugin (CPE: cpe:2.3:a:sadathimel:maxupload_-_big_file_uploads_-_increase_maximum_file_upload_size:*:*:*:*:*:*:*:*) implements resumable chunked file uploads - a technique where large files are split client-side, uploaded in chunks, then reassembled server-side. The vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) arises because the security boundary is applied at the wrong stage: extension filtering and MIME-type checks gate the per-chunk upload (lines L121, L174 in uploader.php), but the final file assembly routine (L201) trusts the resumableFilename parameter from the HTTP request body without re-validating the resolved extension against the allowlist. An attacker submits innocuously-named chunks (e.g., chunk1.jpg) that pass validation, then supplies a resumableFilename of 'shell.php', causing the server to write a PHP file to the WordPress upload directory. The plugin entry point is visible in maxupload-wp.php at L88.

RemediationAI

No vendor-released patched version has been identified at the time of this analysis - no fixed release tag or advisory patch version is referenced in the available intelligence data. Until an update is released, the primary compensating control is to deactivate and remove the MaxUpload plugin from all WordPress installations. If the plugin cannot be removed, restrict PHP execution in the WordPress uploads directory by adding a server-level directive: for Apache, add an .htaccess rule 'php_flag engine off' or 'deny from all' for .php files in wp-content/uploads/; for nginx, add a location block denying PHP processing in the uploads path. This prevents code execution even if a malicious file is successfully written, though it does not prevent the file upload itself. A Web Application Firewall rule blocking POST requests containing resumableFilename parameters with .php, .phtml, .phar, or similar executable extensions to the plugin's upload endpoint is an additional layer. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/70d90c0c-e3c6-4db9-b16d-1442e7e1dc3b for patch availability.