HomeWordPress vulnerabilitiesIptanus File Upload
Iptanus File Upload vulnerabilities
Iptanus File Upload has 20 known vulnerabilities in this database. The most recent published record is dated 1 Oct 2026.
- Known vulnerabilities
- 20
- Active installs
- 10,000+
- Latest version
- 5.2.0
- Last updated
- 26 Sep 2026
- Most recent
- 1 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| SQL injection CVE-2026-62071 | Critical 9.3 | Up to 5.1.10 | Fixed in a later version (latest 5.2.0) | 6 d ago |
| SQL injection CVE-2026-17044 | High 8.6 | Before 5.1.8 | Fixed in 5.1.8 | 9 Aug 2026 |
| SQL injection CVE-2026-66447 | Critical 9.3 | Not yet published | Check for an update | 6 Aug 2026 |
| Security weakness CVE-2025-15546 | Medium 5.4 | Before 5.1.7 | Fixed in 5.1.7 | 14 Jun 2026 |
| Cross-site request forgery (CSRF) CVE-2024-13494 | Medium 4.3 | Before 4.25.3 | Fixed in 4.25.3 | 25 Feb 2025 |
| Path traversal CVE-2024-9939 | High 7.5 | Before 4.24.14 | Fixed in 4.24.14 | 8 Jan 2025 |
| Remote code execution CVE-2024-11635 | Critical 9.8 | Before 4.24.15 | Fixed in 4.24.15 | 8 Jan 2025 |
| Remote code execution CVE-2024-11613 | Critical 9.8 | Before 4.25.0 | Fixed in 4.25.0 | 8 Jan 2025 |
| Path traversal CVE-2024-12719 | Medium 4.3 | Before 4.25.0 | Fixed in 4.25.0 | 7 Jan 2025 |
| Broken access control CVE-2024-39639 | Medium 4.3 | Before 4.24.8 | Fixed in 4.24.8 | 1 Nov 2024 |
| Path traversal CVE-2024-9047 | Critical 9.8 | Before 4.24.12 | Fixed in 4.24.12 | 12 Oct 2024 |
| Cross-site scripting (XSS) CVE-2024-7301 | High 7.2 | Before 4.24.9 | Fixed in 4.24.9 | 16 Aug 2024 |
| Remote code execution CVE-2020-10564 | Critical 9.8 | Before 4.13.0 | Fixed in 4.13.0 | 13 Mar 2020 |
| Arbitrary file upload CVE-2015-9338 | High 7.5 | Before 2.5.0 | Fixed in 2.5.0 | 22 Aug 2019 |
| Arbitrary file upload CVE-2015-9339 | High 7.5 | Before 2.7.1 | Fixed in 2.7.1 | 22 Aug 2019 |
| Arbitrary file upload CVE-2015-9340 | High 7.5 | Before 3.0.0 | Fixed in 3.0.0 | 22 Aug 2019 |
| Arbitrary file upload CVE-2015-9341 | High 7.5 | Before 3.4.1 | Fixed in 3.4.1 | 22 Aug 2019 |
| Cross-site scripting (XSS) CVE-2018-9844 | Medium 6.1 | Before 4.3.4 | Fixed in 4.3.4 | 7 Apr 2018 |
| Cross-site scripting (XSS) CVE-2018-9172 | Medium 5.4 | Before 4.3.3 | Fixed in 4.3.3 | 1 Apr 2018 |
| Cross-site request forgery (CSRF) CVE-2014-5199 | Not scored | Up to 2.4.1 | Fixed in a later version (latest 5.2.0) | 12 Aug 2014 |
Read the published descriptions
- CVE-2026-62071, 1 Oct 2026
- Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. CVE record
- CVE-2026-17044, 9 Aug 2026
- The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users. CVE record
- CVE-2026-66447, 6 Aug 2026
- Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. CVE record
- CVE-2025-15546, 14 Jun 2026
- The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users. CVE record
- CVE-2024-13494, 25 Feb 2025
- The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfu_file_details' function. This makes it possible for unauthenticated attackers to modify user data details associated with uploaded files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE record
- CVE-2024-9939, 8 Jan 2025
- The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory. CVE record
- CVE-2024-11635, 8 Jan 2025
- The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server. CVE record
- CVE-2024-11613, 8 Jan 2025
- The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and allowing a user-defined directory path. This makes it possible for unauthenticated attackers to execute code on the server. CVE record
- CVE-2024-12719, 7 Jan 2025
- The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform limited path traversal to view directories and subdirectories in WordPress. Files cannot be viewed. CVE record
- CVE-2024-39639, 1 Nov 2024
- Broken Access Control vulnerability in Nickolas Bossinas WordPress File Upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress File Upload: from n/a through 4.24.7. CVE record
- CVE-2024-9047, 12 Oct 2024
- The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier. CVE record
- CVE-2024-7301, 16 Aug 2024
- The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. CVE record
- CVE-2020-10564, 13 Mar 2020
- An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call. CVE record
- CVE-2015-9338, 22 Aug 2019
- The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files. CVE record
- CVE-2015-9339, 22 Aug 2019
- The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files. CVE record
- CVE-2015-9340, 22 Aug 2019
- The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files. CVE record
- CVE-2015-9341, 22 Aug 2019
- The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files. CVE record
- CVE-2018-9844, 7 Apr 2018
- The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. CVE record
- CVE-2018-9172, 1 Apr 2018
- The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. CVE record
- CVE-2014-5199, 12 Aug 2014
- Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information. CVE record
What to do if you run Iptanus File Upload
If you run Iptanus File Upload, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Iptanus File Upload vulnerabilities
Free. We email you when a new vulnerability is published for Iptanus File Upload, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.