CVE-2026-15965: MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter
The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handleupload function. This is due to a filename-validation mismatch in the handleupload function where extension and MIME checks are applied to the uploaded chunk's filename but not to the final assembled filename derived from the resumableFilename parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress MaxUpload – Big File Uploads – Increase Maximum File Upload Size pluginto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15965?
CVE-2026-15965 has a high severity rating of 8.8.
What type of vulnerability is CVE-2026-15965?
CVE-2026-15965 is classified as an Unauthenticated Arbitrary File Upload vulnerability.
How can I mitigate CVE-2026-15965?
To mitigate CVE-2026-15965, update the MaxUpload plugin to version 1.4.1 or later, which addresses the vulnerability.
Who is affected by CVE-2026-15965?
All users of the MaxUpload Big File Uploads plugin for WordPress up to and including version 1.4.0 are affected by CVE-2026-15965.
What causes CVE-2026-15965?
CVE-2026-15965 is caused by a filename-validation mismatch in the handle_upload function.