Atomic Edge analysis of CVE-2026-15965 (metadata-based):
This vulnerability affects the MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress, version 1.4.0 and earlier. It is an unauthenticated arbitrary file upload vulnerability with a CVSS score of 8.8. The attack can lead to remote code execution due to the upload of executable files without proper validation.
Root Cause:
The root cause is a filename-validation mismatch in the handle_upload function. The plugin processes file uploads in chunks (resumable uploads) and reassembles them into a final file. During the chunk upload, the plugin validates the extension and MIME type of the uploaded chunk’s filename. However, the final assembled filename, derived from the ‘resumableFilename’ parameter, is not subjected to the same validation. This allows an attacker to supply a final filename with an executable extension (e.g., .php) while the individual chunks carry benign names (e.g., .txt or .bin). Atomic Edge research confirms from the vulnerability metadata that the extension and MIME checks are applied inconsistently, but the exact code implementation is not confirmed because source code is not available.
Exploitation:
An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests to the WordPress AJAX handler. The expected endpoint is /wp-admin/admin-ajax.php with an action parameter that maps to the plugin’s upload handler, likely ‘maxupload_resumable_upload’ or similar. The attacker uploads chunks with valid, safe filenames (e.g., ‘chunk_0.txt’, ‘chunk_1.bin’, etc.) and includes the ‘resumableFilename’ parameter set to a malicious filename such as ‘shell.php’. The plugin’s handle_upload function reassembles the chunks into the final file using the unvalidated ‘resumableFilename’, resulting in a PHP file being written to the uploads directory or a writable plugin directory. The attacker can then access the uploaded file directly via the web server to trigger execution.
Remediation:
Because the patched version is unavailable, immediate mitigation requires a virtual patch at the WAF level to block requests that contain both the file upload action and a ‘resumableFilename’ parameter with a dangerous extension (e.g., .php, .phtml, .php5). The plugin developer must harmonize validation by applying the same extension and MIME checks to the final assembled filename as are applied to individual chunks. Additionally, all file uploads should be routed through WordPress’s allowed file type filtering (e.g., using wp_check_filetype_and_ext) and verify user capabilities and nonces where applicable. Until a vendor patch is released, site administrators should remove or disable the plugin if possible and restrict write permissions on upload directories.
Impact:
Successful exploitation allows an unauthenticated attacker to upload arbitrary files, including web shells, to the WordPress server. This can result in remote code execution, complete compromise of the underlying server, data theft, website defacement, and lateral movement within the hosting environment. Since the vulnerability requires no authentication, any attacker with network access can exploit it.
