CVE-2011-10041

Critical

Published: 15/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

An arbitrary file upload vulnerability in Uploadify WordPress plugin up to version 1.0 due to missing file type validation in process_upload.php. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.

Risk Assessment

Risk of remote code execution on the server, potentially leading to full compromise of the website and data.

Recommendation

Update the Uploadify plugin to the latest version or remove it if not essential, and implement file type validation.

Original NVD description (English source)

Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.