Description

Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-18T15:16:57.563Z",
  "pubdate": "2026-08-18T15:16:57.563Z",
  "executiveSummary": "An arbitrary file upload vulnerability exists in the GP Premium plugin, affecting versions up to and including 2.5.5. This security flaw allows authenticated users with low-level privileges, specifically the Contributor role, to upload arbitrary files to the underlying web server. The primary impact of this vulnerability is potential Remote Code Execution (RCE) and system compromise, as an attacker could upload malicious scripts or executables into accessible directories within the WordPress environment. The affected product is GP Premium across all versions equal to or less than 2.5.5. The risk implications are severe, as successful exploitation circumvents intended file type restrictions and validation controls enforced by the application. The attacker capabilities are bounded by the requirement of possessing a Contributor-level account on the target WordPress instance, enabling them to leverage authenticated endpoints improperly. Exploitation requirements mandate authenticated access with at least Contributor privileges, allowing the user to interact with vulnerable upload mechanisms present in the plugin codebase.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient file type verification within the file handling mechanisms of GP Premium versions 2.5.5 and prior. Specifically, the vulnerable component fails to adequately restrict or sanitize user-supplied file uploads processed during specific plugin operations accessible to the Contributor role. Authentication and privilege requirements dictate that the attacker must possess an authenticated session with a minimum of Contributor-level privileges on the target WordPress installation. Network exposure is standard for web-facing WordPress deployments reachable via HTTP/HTTPS protocols. The root cause is rooted in flawed validation logic that allows unauthorized or dangerous file extensions to bypass intended security controls during the upload sequence. The step-by-step attack flow proceeds as follows: First, the authenticated attacker with Contributor privileges navigates to or interacts with the vulnerable functionality exposed by the GP Premium plugin. Second, the attacker crafts an HTTP request containing a malicious payload, such as a web shell or executable script masked with an overlooked or improperly sanitized file extension. Third, the application processes the upload request within the vulnerable component, failing to perform rigorous MIME-type checking or extension blacklisting/whitelisting. Fourth, the server stores the uploaded payload within a web-accessible directory. Finally, the payload exhibits malicious behavior upon direct HTTP request execution by the attacker, leading to post-exploitation impact such as arbitrary code execution, unauthorized access to sensitive database configurations, privilege escalation, or full system compromise of the underlying host environment."
}