Attacks Dictionary
File upload vulnerability
Definition
A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.
Also called: unrestricted file upload, arbitrary file upload
Why it matters for WordPress
WordPress sites upload media all day. When a form or plugin fails to validate type, size, or path, attackers upload .php (or double extensions) and browse to it. That is one of the most common ways webshells land.
How it shows up in practice
- PHP files under
wp-content/uploads - CVE text about missing filetype checks on an AJAX upload handler
- Contact forms or builders that accept “any file” into a web-reachable folder
- Executed uploads even when the UI said “images only”
What to do
- Keep form and builder plugins updated; upload bugs are frequent.
- Block PHP execution in uploads at the server when the host allows it.
- Restrict who can upload; not every role needs
upload_files. - After a bad upload, remove the file, close the hole, scan for siblings, rotate credentials.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Webshell A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Remote code execution Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.