WordPress File Upload: Unauthenticated File Deletion & Remote Code Execution

Threat Overview

A critical security vulnerability in the WordPress File Upload plugin allows unauthenticated remote attackers to delete arbitrary files on the hosting server, trigger denial-of-service states, and achieve full remote code execution.

Tracked as CVE-2026-3829, the vulnerability arises from insufficient path sanitization in the plugin’s AJAX file handling and chunk-upload handlers. Because the plugin is commonly used on corporate contact forms, career application pages, and document intake portals, public visitors can exploit the handler without needing login credentials.

The Breakdown: How the Exploit Works

The WordPress File Upload plugin allows administrators to place file-upload forms on any page using shortcodes. To support large files, the plugin features a chunked upload mechanism that writes temporary file parts to the server and combines them upon completion.

In versions prior to 4.25.4, the temporary file cleanup and file relocation routines failed to properly sanitize directory traversal sequences (../) supplied in upload parameters.

An unauthenticated attacker can supply path traversal parameters that cause the cleanup routine to delete critical server files—including wp-config.php or .htaccess. When wp-config.php is deleted, WordPress reverts to its initial installation state (/wp-admin/install.php), allowing the attacker to connect to their own external database, complete the setup wizard, and seize full control of the domain. Furthermore, flawed file type checking during chunk assembly allows attackers to reconstruct executable PHP webshells inside public directories.

The Operational Risk: What an Attacker Gains

• Total Site Reset & Hijacking: Deletion of wp-config.php allows external attackers to run the WordPress installation wizard and register themselves as the root owner.
• Direct Server RCE: Reassembled webshells grant interactive command execution under the web server process permissions.
• Catastrophic Data Loss: Attackers can systematically delete system files, media libraries, database backups, and custom plugins.
• Persistent Malware Installation: Intruders inject hidden redirect scripts, spam backdoors, and malware droppers into core theme files.

Our Take in Plain English

“Giving customers a way to send resumes, project files, or documents is basic business hygiene. But on a traditional WordPress site, every file-upload form is an open communication line with your operating system’s filesystem. When a plugin allows attackers to delete configuration files or write executable code, a routine contact form becomes a catastrophic vulnerability. Modern businesses protect their digital assets by routing customer uploads straight into isolated cloud vaults where code can never execute.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: File uploads and temporary chunk assembly happen directly on the application web server, where path manipulation can overwrite or delete core operating files.
• Modern Pre-Rendered Edge Architecture: Front-end intake forms submit directly to edge serverless functions that stream files securely into quarantined cloud object storage (such as Cloudflare R2 or AWS S3), completely isolated from any application runtime or web server filesystem.

Immediate Action Items for WordPress Operators

1. Update WordPress File Upload Immediately: Ensure the plugin is updated to version 4.25.4 or higher without delay.
2. Back Up wp-config.php: Maintain offline, read-only backups of critical configuration files and restrict file permissions on the server (chmod 400 wp-config.php).
3. Audit File System Integrity: Scan web root and plugin directories for missing system files or anomalous .php scripts in temporary upload folders.
4. Harden Upload Storage: Ensure web server configuration explicitly blocks PHP script execution inside all media and upload directories.