Improper file upload rules allow attackers to upload dangerous scripts.
Unrestricted File Upload
Key Points: Attackers upload malicious files (PHP, JS) disguised as images or docs if no restrictions are enforced.
Your form lets users upload anything — what could go wrong? A lot. Without file type and size validation, even a contact form becomes a backdoor.
⚠️ Common Oversights
- No MIME type validation
- Uploads allowed outside of
wp-content/uploads - No renaming or sanitization of file names
🛠️ How to Lock It Down
- Restrict allowed file types with
wp_check_filetype() - Use file renaming and path sanitization
- Scan uploads and monitor newly added files regularly
🔍 Bonus
Even image uploads can carry PHP code — always double-check how forms handle files.