Understanding and Defending Against Arbitrary File Upload Vulnerability in MaxUpload Plugin
The MaxUpload plugin for WordPress is vulnerable to an arbitrary file upload attack due to a filename-validation mismatch. This allows unauthenticated attackers to upload potentially executable files, leading to remote code execution. The vulnerability has a CVSS score of 8.8 and affects all versions up to and including 1.4.0.