---
title: File upload vulnerability
canonical: https://wpsecurityninja.com/dictionary/file-upload-vulnerability/
---
# File upload vulnerability

A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.

Last updated: 2026-08-26

Also called: unrestricted file upload, arbitrary file upload

## Related terms

- [Webshell](https://wpsecurityninja.com/dictionary/webshell/): A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- [Malware](https://wpsecurityninja.com/dictionary/malware/): Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- [Remote code execution](https://wpsecurityninja.com/dictionary/remote-code-execution/): Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.
- [Backdoor](https://wpsecurityninja.com/dictionary/backdoor/): A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.

[Full guide](https://wpsecurityninja.com/wordpress-backdoor-hacks-what-to-know/)

## Why it matters for WordPress

WordPress sites upload media all day. When a form or plugin fails to validate type, size, or path, attackers upload `.php` (or double extensions) and browse to it. That is one of the most common ways webshells land.

## How it shows up in practice

- PHP files under `wp-content/uploads`
- CVE text about missing filetype checks on an AJAX upload handler
- Contact forms or builders that accept “any file” into a web-reachable folder
- Executed uploads even when the UI said “images only”

## What to do

1. Keep form and builder plugins updated; upload bugs are frequent.
2. Block PHP execution in uploads at the server when the host allows it.
3. Restrict who can upload; not every role needs `upload_files`.
4. After a bad upload, remove the file, close the hole, scan for siblings, rotate credentials.