Custom Upload Dir Security & Risk Analysis

wordpress.org/plugins/custom-upload-dir

Keeps your uploaded files organized in smart folder structures.

5K active installs v3.4.6 PHP 5.2+ WP 3.9+ Updated Jul 26, 2022
filesmediaorganizeupload
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Custom Upload Dir Safe to Use in 2026?

Generally Safe

Score 85/100

Custom Upload Dir has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 3yr ago
Risk Assessment

The custom-upload-dir plugin v3.4.6 exhibits a strong security posture based on the provided static analysis. The absence of AJAX handlers, REST API routes, shortcodes, and cron events significantly limits its attack surface. The code also demonstrates good practices by not utilizing dangerous functions, performing all SQL queries with prepared statements, and avoiding external HTTP requests. The presence of capability checks, although only one is noted, is a positive sign for access control.

Key Concerns

  • Output escaping not fully implemented
  • Lack of nonce checks across entry points
Vulnerabilities
None known

Custom Upload Dir Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

Custom Upload Dir Release Timeline

v3.4.6Current
v3.4.5
v3.4.4
v3.4.3.2
v3.4.3.1
v3.4.2
v3.4
v3.3.2
v3.3.1
v3.3
v3.0.2
v3.0.1
v3.0
v2.5.4
v2.5.3
v2.5.2
v2.5.1
v2.5
Code Analysis
Analyzed Mar 16, 2026

Custom Upload Dir Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
3
8 escaped
Nonce Checks
0
Capability Checks
1
File Operations
0
External Requests
0
Bundled Libraries
0

Output Escaping

73% escaped11 total outputs
Attack Surface

Custom Upload Dir Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 9
actionplugins_loadedcustom_upload_dir.php:18
filterwp_handle_upload_prefiltercustom_upload_dir.php:28
actionxmlrpc_callcustom_upload_dir.php:29
filterwp_handle_uploadcustom_upload_dir.php:30
actionadmin_initcustom_upload_dir.php:31
actionadmin_menucustom_upload_dir.php:32
filterplugin_row_metacustom_upload_dir.php:33
filterupload_dircustom_upload_dir.php:122
actionin_admin_footercustom_upload_dir.php:459
Maintenance & Trust

Custom Upload Dir Maintenance & Trust

Maintenance Signals

WordPress version tested6.0.11
Last updatedJul 26, 2022
PHP min version5.2
Downloads110K

Community Trust

Rating88/100
Number of ratings25
Active installs5K
Developer Profile

Custom Upload Dir Developer Profile

ulfben

6 plugins · 5K total installs

84
trust score
Avg Security Score
85/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Custom Upload Dir

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/custom-upload-dir/

HTML / DOM Fingerprints

HTML Comments
<!-- TODO:/* @param array $file Reference to a single element of $_FILES. Call the function once for each uploaded file.NOTE: since WP 3.3 this filter is only run between wp_handle_upload_prefilter and wp_handle_upload - thus I removed thechecks for redundant calls when viewing the media library.+44 more
FAQ

Frequently Asked Questions about Custom Upload Dir