MaxUpload: Unauthenticated Arbitrary File Upload
MaxUpload WP plugin (≤1.4.0): unauthenticated arbitrary file upload via filename validation mismatch in chunked upload assembly. CVSS 8.8 High, no patch confirmed.
- Vendor
- MaxUpload
- Product
- MaxUpload – Big File Uploads – Increase Maximum File Upload Size for WordPress
- CVSS
- 8.8
- EPSS (exploit probability)
- 0.6%
- Status
- unpatched
- Published
The MaxUpload plugin for WordPress (all versions through 1.4.0) implements chunked file
upload handling via its handle_upload function. The function applies extension and
MIME-type validation to the uploaded chunk’s filename. The filename that determines where
the final assembled file lands on the server is derived from a separate parameter and is
not subject to the same validation checks.
The gap between what is validated and what ends up on the filesystem is reachable by any unauthenticated visitor — no WordPress account or session is required to trigger the handler. The result: an attacker can upload arbitrary file types to a WordPress server running an affected version of MaxUpload.
Affected versions: all versions through 1.4.0
Fixed in: no patched version confirmed as of 2026-08-15 — check the
WordPress plugin repository
for current release status
What to do: Deactivate or remove MaxUpload until a patched version is confirmed
available. There is no safe configuration workaround for the flaw in affected versions.
As a secondary measure, confirm with your hosting provider that your WordPress upload
directory is not configured to execute server-side scripts.
