CVE-2026-15965 affects the MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress in all versions up to and including 1.4.0. The vulnerability is due to improper validation of the final assembled filename derived from the resumableFilename parameter in the handle_upload function. While extension and MIME type checks are performed on individual uploaded chunks, these checks are not applied to the final filename, allowing arbitrary file upload of dangerous file types. This flaw can be exploited by unauthenticated attackers to upload executable files, potentially leading to remote code execution on the affected system.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable ones, to the server running the vulnerable plugin. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.8, indicating a high severity vulnerability with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality and monitor for suspicious uploads. Avoid using versions up to and including 1.4.0 in production environments. Follow vendor communications for updates on patches or official fixes.