Log in Start free

Vulnerability · Published Aug 15, 2026 · Assigned by Wordfence

CVE-2026-15965MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter

High 8.8

In plain English

A high-severity unrestricted file upload in MaxUpload – Big File Uploads – Increase Maximum File Upload Size from sadathimel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 36.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handle_upload function. This is due to a filename-validation mismatch in the handle_upload function where extension and MIME checks are applied to the uploaded chunk's filename but not to the final assembled filename derived from the resumableFilename parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Affected products (as reported)

VendorProductVersions
sadathimel MaxUpload – Big File Uploads – Increase Maximum File Upload Size 0 – through 1.4.0

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References