Plugin upload is the process of adding plugin code to a WordPress site, commonly by submitting a ZIP file through the administration dashboard. Installing plugins can add legitimate features, but uploaded code may also run with the site's privileges. For that reason, WordPress limits plugin installation to users with an appropriate capability, such as administrators, and may apply additional file and request checks.
In an attack, malicious JavaScript that can act through an authenticated administrator's browser may try to reach the plugin upload page and obtain the security token needed for the action. If the request succeeds, an attacker could install and activate a plugin containing a PHP backdoor. Defenses include limiting plugin-installation privileges, protecting administrator sessions, reviewing unexpected plugin changes, and monitoring site files and administrative activity.