WordPress Plugin Vulnerabilities

WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload

Description

The plugin does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.

Proof of Concept

Affects Plugins

Plugin icon
web-to-print-online-designer
Fixed in 2.15.0

References

CVE
CVE-2026-82187

Miscellaneous

Original Researcher
Mike Gozdiskowski
Submitter
Mike Gozdiskowski
Verified
Yes
WPVDB ID
d3e49486-6c08-41d5-86c9-3aaff670fc63

Timeline

Publicly Published
2026-09-19 (about 2 days ago)
Added
2026-09-19 (about 1 day ago)
Last Updated
2026-09-19 (about 1 day ago)

Other

Published
Title
Published
2023-12-27
Title
JVM rich text icons < 1.2.4 - Subscriber+ Arbitrary File Upload
Published
2025-05-16
Title
TI WooCommerce Wishlist < 2.10.0 - Unauthenticated Arbitrary File Upload
Published
2024-08-12
Title
Media Library Assistant < 3.19 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
Published
2026-05-27
Title
Crawlomatic Multipage Scraper Post Generator < 2.7.3 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute
Published
2024-11-13
Title
B-Banner Slider <= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload