CVE-2016-20075: WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload (CVSS 8.8)

Technical summary

CVE-2016-20075 is an arbitrary file upload vulnerability (CWE-863) in WordPress Ultimate Product Catalog 3.8.6. The plugin's custom file field functionality in the Products tab fails to properly validate or restrict file types before storage. Uploaded files are placed in the upcp-product-file-uploads directory without sufficient access controls, making them executable. An authenticated attacker with contributor-level or higher privileges can upload a PHP shell, then request it directly to achieve remote code execution on the underlying server.

Business impact

A successful exploit gives an attacker the ability to run arbitrary code on your WordPress server with the same privileges as the web process. This enables complete website takeover, unauthorized data access or exfiltration, malware installation, defacement, lateral movement into your network, and potential compromise of customer data or payment systems. For organizations using this plugin, the risk extends beyond the website itself if the server hosts other applications or has network access to internal systems.

Affected systems

WordPress sites running Ultimate Product Catalog version 3.8.6 are vulnerable. The plugin is used by e-commerce and product catalog sites. Any installation of that specific version is at risk if users with contributor, editor, or author roles exist—either trusted staff or accounts that have been compromised. Administrator accounts are also exploitable, though they already have broad capabilities. Verify your installed version in wp-content/plugins/ultimate-product-catalog/ or your plugin management dashboard.

Exploitability

Exploitation requires valid WordPress user credentials at contributor level or above. An attacker must either have legitimate site access (insider threat) or have compromised an existing user account. The attack itself is straightforward: navigate to the Products section, use the custom file field to upload a PHP file, then access it via the upcp-product-file-uploads directory. There is no complex server configuration, race condition, or user interaction required beyond the file upload. The CVSS score of 8.8 reflects the high severity—high confidentiality, integrity, and availability impact, though privilege requirement (low-complexity network attack) moderates it from critical.

Remediation

Update WordPress Ultimate Product Catalog to the patched version released after 3.8.6. Verify the patch version against the plugin developer's security advisory or changelog. Immediately deactivate and remove the plugin if patching is not available or if you do not need it. As an interim measure, apply the principle of least privilege: remove contributor, editor, or author roles from users who do not actively require them, and regularly audit user accounts for unauthorized or stale access.

Patch guidance

Check the official Ultimate Product Catalog plugin repository or vendor security advisory for the patched version number and release date. Patch versions released after June 2026 (the CVE publication date) are likely to address this issue—verify against the advisory. Prioritize this update for production WordPress sites, as the vulnerability is in a commonly used plugin function. Test in a staging environment first to ensure compatibility with your theme and other plugins, then deploy to production. After patching, audit the upcp-product-file-uploads directory for any suspicious or non-image files.

Detection guidance

Review user accounts with contributor, editor, or author roles and verify their legitimacy and activity. Check the upcp-product-file-uploads directory for unexpected file types, particularly .php, .phtml, .php5, or executable files. Enable WordPress audit logging or use a security plugin to monitor file uploads and user privilege changes. Look for HTTP requests to the upcp-product-file-uploads directory that reference .php files or show 200 (successful) responses to executable file requests. Review web server logs for POST requests to the Products tab or custom field endpoints, and cross-reference with known user activity.

Why prioritize this

This vulnerability warrants immediate prioritization because it enables unauthenticated remote code execution following privilege compromise, affects a plugin used in e-commerce contexts where data sensitivity is high, requires only low-complexity exploitation, and carries full impact across confidentiality, integrity, and availability. While it requires prior authentication, the barrier is a single compromised or malicious user account—a realistic scenario in multi-user WordPress environments. The 8.8 CVSS severity and the ease of exploitation make this a must-patch issue.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Network-based attack vector (N), low attack complexity (L), low privilege requirement (L), no user interaction required (N), and high impact to confidentiality (H), integrity (H), and availability (H). The score does not account for the rarity of the plugin, the presence of contributor-level users on your site, or your network's sensitivity. In an organization with many WordPress sites or high-value hosted data, the actual business risk may be higher; in sites with strictly controlled user roles, it may be lower.

Frequently asked questions