PT-2026-49213 · Undefined · Undefined

Published 2026-06-15 · Updated 2026-06-15 · CVE-2016-20075

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2016-20075

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-20075 · Security Note
• http://etoilewebdesign.com · Note
• https://vulncheck.com/advisories/wordpress-ultimate-product-catalog-arbitrary-file-upload-rce · Note
• https://exploit-db.com/exploits/40012 · Note