# Iptanus File Upload <= 5.2.0 - Unauthenticated Information Exposure via 'params_index' Parameter

- **ID:** WPSEC-2026-1124
- **Plugin:** Iptanus File Upload (`wp-file-upload`), https://wordpress.org/plugins/wp-file-upload/
- **Affected versions:** all versions before 5.2.1
- **Fixed in:** 5.2.1 (Update to 5.2.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-file-upload
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1124/

## Description

The Iptanus File Upload plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'params_index' parameter of the upload AJAX handler in all versions up to, and including, 5.2.0. This is due to the request-supplied value being placed unescaped into a regular expression when the stored upload form parameter index is looked up, combined with the 'User failed!' error response that returns the matched index entry regardless of debug mode. This makes it possible for unauthenticated attackers to make the lookup match index entries that belong to other users and read the usernames of users who have loaded an upload form, such as administrators. The entries also include the page and shortcode identifiers.

## References

- https://wpsec.com/vuln/WPSEC-2026-1124/
- https://plugins.svn.wordpress.org/wp-file-upload/tags/5.2.1/
- https://wordpress.org/plugins/wp-file-upload/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1124/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.