Description

The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-21T07:16:53.317Z",
  "pubdate": "2026-09-21T07:16:53.317Z",
  "executiveSummary": "The Web to Print Online Designer WordPress plugin before 2.15.0 contains a critical arbitrary file upload vulnerability. This vulnerability is categorized as a failure to implement proper input validation, allowing unauthenticated remote attackers to bypass security restrictions and upload malicious files to the server.\nThe primary risk involves the potential for remote code execution (RCE) by uploading executable scripts, such as PHP files, which the web server may process and execute. This exposes the entire WordPress environment, including the underlying server, to complete system compromise. The vulnerability is highly severe because it does not require administrative privileges or user authentication for exploitation. Attackers can leverage this flaw to deploy backdoors, exfiltrate sensitive database information, pivot into the internal network, or launch secondary attacks against site visitors. Organizations using affected versions of this plugin are at immediate risk of full site takeover and should prioritize remediation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation of user-supplied file uploads within the Web to Print Online Designer plugin. The implementation fails to restrict or verify the MIME type or the file extension of incoming data streams, allowing for the unrestricted transfer of arbitrary file formats to the server's filesystem.\nFurthermore, the plugin's architectural design incorrectly manages the security tokens assigned to file upload sessions. Instead of restricting access to these tokens to authorized users or authenticated sessions, the application insecurely exposes these tokens to any visitor who requests them. An attacker can programmatically request a valid upload token and subsequently leverage that token to bypass the plugin's intended workflow, effectively injecting malicious payloads into the server's upload directory.\nThe exploitation flow proceeds as follows: First, the attacker identifies the endpoint responsible for file uploads and the mechanism for generating upload tokens. Second, the attacker interacts with the plugin to acquire a valid token without needing to authenticate. Third, the attacker sends a multipart/form-data request containing a malicious payload—typically a PHP web shell—masquerading as a legitimate upload, utilizing the acquired token to authorize the request. Because the plugin performs no validation on the uploaded file's structure or content, the server saves the malicious script to a publicly accessible directory.\nOnce the file is successfully uploaded, the attacker can trigger remote code execution by sending a direct HTTP GET request to the path of the uploaded file. Upon execution, the payload runs with the privileges of the web server process (e.g., www-data). This enables the attacker to execute arbitrary system commands, modify WordPress database entries, alter configuration files, or deploy persistent malware within the web root. The impact is catastrophic, as it allows for total system compromise, including unauthorized access to site data, user credentials, and server-side environment variables. This vulnerability affects all versions of the Web to Print Online Designer plugin prior to 2.15.0 and is accessible over the network without any requirement for prior authorization or elevated privileges."
}