CVE-2026-15965 describes an arbitrary file upload vulnerability in the MaxUpload – Big File Uploads – Increase Maximum File Upload Size WordPress plugin. The issue arises from a filename-validation mismatch in the handle_upload function, where extension and MIME type checks are applied only to the uploaded chunk's filename but not to the final assembled filename derived from the resumableFilename parameter. This flaw enables unauthenticated attackers to upload files with dangerous types, potentially leading to remote code execution. The vulnerability affects all versions up to and including 1.4.0.

Successful exploitation allows unauthenticated attackers to upload arbitrary files that may be executable, resulting in full remote code execution on the affected system. This compromises confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions and monitor for suspicious uploads related to this plugin. Avoid using affected versions in production environments if possible.