Iptanus File Upload <= 5.2.0 - Unauthenticated Information Exposure via 'params_index' Parameter
- ID
- WPSEC-2026-1124
- Plugin
- Iptanus File Upload (wp-file-upload)
- Affected
- all versions before 5.2.1
- Remediation
- Update to 5.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Iptanus File Upload on WPSec AttackSurface
- Fix released
- Published
Description
The Iptanus File Upload plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'params_index' parameter of the upload AJAX handler in all versions up to, and including, 5.2.0. This is due to the request-supplied value being placed unescaped into a regular expression when the stored upload form parameter index is looked up, combined with the 'User failed!' error response that returns the matched index entry regardless of debug mode. This makes it possible for unauthenticated attackers to make the lookup match index entries that belong to other users and read the usernames of users who have loaded an upload form, such as administrators. The entries also include the page and shortcode identifiers.
References
- https://wpsec.com/vuln/WPSEC-2026-1124/
- https://plugins.svn.wordpress.org/wp-file-upload/tags/5.2.1/
- https://wordpress.org/plugins/wp-file-upload/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS