CVE-2011-10041 Uploadify <= 1.0 Unauthenticated Arbitrary File Upload
Unauthenticated attackers can upload arbitrary files to the WordPress site, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-10041?
CVE-2011-10041 is a critical vulnerability in Steven Uploadify, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.
Weakness: CWE-434
Which versions are affected by CVE-2011-10041?
How do I fix CVE-2011-10041?
No fix has been published for CVE-2011-10041 yet. Limit exposure of the affected software until one is available.
Is CVE-2011-10041 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-10041 exists.
Sources
Also known as GHSA-vf5j-jhr7-6gmg.