Arbitrary File Upload in MaxUpload WordPress Plugin

The MaxUpload - Big File Uploads - Increase Maximum File Upload Size plugin for WordPress (versions 1.4.0 and earlier) contains a critical arbitrary file upload vulnerability. The vulnerability resides in the handle_upload function, which manages file chunk uploads. The plugin fails to validate the final filename generated from the 'resumableFilename' parameter during the file assembly process, despite correctly applying validation checks to individual uploaded chunks. This mismatch allows unauthenticated attackers to supply a malicious filename that bypasses extension and MIME type restrictions. By successfully manipulating the assembly process, an attacker can upload executable files (such as .php files) to the web server, leading to unauthenticated remote code execution. This poses a significant risk to WordPress installations where this plugin is active, as it facilitates direct compromise of the underlying web server infrastructure.

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected WordPress server. This could lead to full site takeover, data exfiltration, lateral movement within the network, or the installation of persistent backdoors. Given the nature of the vulnerability, the potential impact is critical for any organization hosting enterprise or sensitive data on a WordPress platform using this plugin.

Recommendation

• Update the "MaxUpload - Big File Uploads - Increase Maximum File Upload Size" plugin to the latest patched version immediately.
• If patching is not possible, disable the plugin and remove the affected code path from the server until a fix is deployed.
• Monitor web server access logs for anomalous POST requests targeting the handle_upload endpoint, particularly those containing suspicious filename patterns or non-standard file extensions in the resumableFilename parameter.
• Deploy file integrity monitoring on the WordPress 'wp-content/uploads' directory to detect the unauthorized creation of executable files.