The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to arbitrary file upload due to a filename‑validation mismatch in the handle_upload function. The vulnerability allows an attacker to upload a file with a malicious executable extension because the final assembled filename, derived from the resumableFilename parameter, is not checked against the file's MIME type or extension restrictions. This flaw can lead to remote code execution when the uploaded file is served or executed on the target server.

WordPress installations that use the MaxUpload plugin, versions up to and including 1.4.0. All earlier releases are affected.

The CVSS score of 8.8 indicates a high severity, with a substantial exploitation likelihood based on the lack of authentication required for the attack. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the remote code execution potential and the wide user base of WordPress make this a significant risk. Attackers can exploit the flaw by submitting a file via the resumableFilename parameter without authentication, leading to an arbitrary file being written to the server and potentially executed.