Description

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handle_upload function. This is due to a filename-validation mismatch in the handle_upload function where extension and MIME checks are applied to the uploaded chunk's filename but not to the final assembled filename derived from the resumableFilename parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T03:16:48.077Z",
  "pubdate": "2026-08-15T03:16:48.077Z",
  "executiveSummary": "The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to an Arbitrary File Upload vulnerability across all versions up to, and including, 1.4.0. This critical security flaw stems from a filename-validation mismatch within the handle_upload function. The vulnerability allows unauthenticated remote attackers to bypass file extension and MIME type security controls during chunked file uploads. By manipulating the resumableFilename parameter, an attacker can bypass initial validation checks applied only to temporary chunk filenames and force the system to assemble and store malicious files with executable extensions on the underlying web server. Successful exploitation of this vulnerability directly leads to remote code execution, granting the attacker complete system compromise, unauthorized access to the underlying WordPress installation, data exfiltration capabilities, and potential pivot opportunities within the hosting infrastructure. Because the flaw can be exploited without prior authentication or elevated privileges over the network, it presents an extreme risk to confidentiality, integrity, and availability. Immediate remediation is required to secure affected WordPress environments against potential exploitation attempts.",
  "technicalDetails": "The vulnerability resides in the handle_upload function of the MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress, affecting all versions up to, and including, 1.4.0. The root cause of the security flaw is a filename-validation mismatch during the processing of chunked file uploads. When a file is uploaded in chunks, the plugin performs security validations such as extension verification and MIME type checking exclusively on the temporary chunk filenames. However, it fails to enforce these same rigorous checks on the final assembled filename, which is derived independently from the resumableFilename parameter supplied in the upload request. This architectural validation gap enables malicious actors to craft HTTP requests containing safe, benign extensions for the individual uploaded chunks to successfully pass initial validation routines, while specifying an arbitrary executable extension, such as a PHP script, within the resumableFilename parameter. During the file assembly phase, the application combines the chunks and saves the resulting file using the attacker-controlled resumableFilename. The attack flow commences with an unauthenticated attacker sending specially crafted HTTP requests to the vulnerable endpoint exposed by the plugin. The attacker leverages the network exposure of the WordPress site to interact directly with the vulnerable handle_upload function without requiring any authentication or user privileges. By supplying a multipart payload with manipulated resumable parameters, the attacker bypasses all security gates intended to restrict dangerous file uploads. Once the server processes the request and writes the assembled file to a web-accessible directory, the attacker can directly invoke the newly uploaded script via standard HTTP requests. This execution of arbitrary code within the context of the web server user leads to complete system compromise, allowing post-exploitation activities such as defacement, database manipulation, credential theft, and deployment of persistent web shells."
}