CVE-2011-10041CWE-434

Uploadify <= 1.0 Unauthenticated Arbitrary File Upload

Critical · published January 15, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00813 · 56.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-01-15T21:44Z
EPSS history
Timeline
  • 15 JAN 21:44Z
    Uploadify <= 1.0 Unauthenticated Arbitrary File Upload
    cvelistv5