---
title: File upload vulnerability
canonical: https://wpsecurityninja.com/dictionary/file-upload-vulnerability/
---
# File upload vulnerability

A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.

[Full guide](https://wpsecurityninja.com/wordpress-backdoor-hacks-what-to-know/)

## Why it matters for WordPress

WordPress sites upload media all day. When a form or plugin fails to validate type, size, or path, attackers upload `.php` (or double extensions) and browse to it. That is one of the most common ways webshells land.

## How it shows up in practice

- PHP files under `wp-content/uploads`
- CVE text about missing filetype checks on an AJAX upload handler
- Contact forms or builders that accept “any file” into a web-reachable folder
- Executed uploads even when the UI said “images only”

## What to do

1. Keep form and builder plugins updated; upload bugs are frequent.
2. Block PHP execution in uploads at the server when the host allows it.
3. Restrict who can upload; not every role needs `upload_files`.
4. After a bad upload, remove the file, close the hole, scan for siblings, rotate credentials.