Description

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-11T07:16:45.980Z",
  "pubdate": "2026-09-11T07:16:45.980Z",
  "executiveSummary": "The teddy-bear-customize-addon WordPress plugin, specifically versions 1.0.5 and below, contains a critical arbitrary file upload vulnerability. The flaw originates from insufficient validation of user-supplied files, allowing unauthenticated attackers to bypass security controls by manipulating the Content-Type header and retaining the original filename.\nThis vulnerability poses a severe risk, enabling remote code execution (RCE) on the underlying web server. By successfully uploading a malicious PHP script, an attacker can gain full control over the application, execute arbitrary system commands, steal sensitive database information, or deploy malware within the hosting environment. As the exploitation process does not require authentication or elevated privileges, the attack surface is significantly exposed to any internet-facing instance of the plugin. Remediation is essential to prevent complete server compromise, as the integrity, confidentiality, and availability of the entire WordPress installation are directly threatened by this security flaw.",
  "technicalDetails": "The vulnerability resides within the file upload handling logic of the teddy-bear-customize-addon plugin. The root cause is a failure to implement robust server-side validation of file metadata and content. Instead of verifying the file's actual MIME type, structure, or content against an allow-list, the plugin relies exclusively on the client-supplied Content-Type header provided during the HTTP POST request. Because this header is entirely controlled by the client, it is easily spoofed.\nFurthermore, the plugin preserves the original filename submitted by the user. If an attacker submits a file with a .php extension, the application stores this file in a publicly accessible web directory without renaming it or neutralizing the extension. This behavior permits the placement of arbitrary PHP scripts within the document root.\nThe attack flow follows a predictable sequence: First, an unauthenticated attacker identifies an entry point within the plugin designed to handle file uploads. Second, the attacker crafts a multipart/form-data request containing a malicious payload—typically a web shell—while setting the Content-Type header to simulate a benign file format (such as image/jpeg). Third, the plugin processes the request and saves the malicious file to the server's storage directory, utilizing the attacker-defined filename. Finally, the attacker navigates their browser or a tool like cURL directly to the uploaded file's URL. The web server interprets the file as an executable PHP script, executing the injected code with the permissions of the web server user (e.g., www-data).\nThis vulnerability is classified as critical because it grants an unauthenticated, remote attacker the ability to bypass all existing authentication mechanisms of the WordPress installation. Post-exploitation impact is extensive; once remote code execution is achieved, the attacker can move laterally within the server, compromise the database credentials defined in wp-config.php, intercept administrative sessions, or use the server as a pivot point for further attacks on the internal network. The lack of validation on both the file extension and the file content ensures that attackers can successfully bypass simple security filters that might otherwise check for binary signatures or header consistency, making this a trivial yet highly impactful exploit for versions 1.0.5 and lower."
}