Arbitrary File Upload Vulnerability in MaxUpload Plugin for WordPress
CVE-2026-15965

8.8HIGH

Key Information:

Vendor

WordPress
Status
Maxupload – Big File Uploads – Increase Maximum File Upload Size
Vendor
CVE Published:
15 August 2026

What is CVE-2026-15965?

The MaxUpload – Big File Uploads plugin for WordPress is susceptible to an Arbitrary File Upload due to improper filename validation in the handle_upload function. Specifically, while the plugin conducts extension and MIME checks on the uploaded file chunks, it neglects to apply these validations to the final filename constructed from the resumableFilename parameter. Consequently, this flaw allows unauthenticated attackers to upload potentially executable files, enabling remote code execution and posing significant security risks to affected WordPress installations.

Affected Version(s)

MaxUpload – Big File Uploads – Increase Maximum File Upload Size 0 <= 1.4.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/maxupload-uplo...
https://plugins.trac.wordpress.org/browser/maxupload-uplo...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JIWOONG LEE (kimchunbok)
.