CVE-2016-20075

Vulnerability

The vulnerability resides in the UPCP_Handle_File_Upload function in Functions/Update_Admin-Databases.php of the WordPress Ultimate Product Catalog plugin version 3.8.6 and below. The function does not validate file extensions, allowing authenticated users to upload arbitrary files through the custom fields functionality. When a custom field of type "file" is added and a product is saved, the uploaded file is moved to the wp-content/uploads/upcp-product-file-uploads/ directory without any extension check [1].

Exploitation

An attacker must have an authenticated WordPress account with at least the contributor role (or editor, author, administrator). The exploitation steps are: 1) Navigate to the "Custom fields" tab and add a new custom field with type "file". 2) Go to the "Products" tab, locate the newly added file field, select a PHP shell file, and save the product. 3) Access the uploaded shell at http(s):////wp-content/uploads/upcp-product-file-uploads/ to execute arbitrary PHP code [1]. No additional user interaction is required beyond the attacker's own actions.

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the server, leading to full compromise of the WordPress site. The attacker gains the ability to read, write, and delete files, access the database, and potentially pivot to other systems [1][3].

Mitigation

As of the available references, the vendor (Etoile Web Design) has not released a patched version for this vulnerability [2]. Users should upgrade to a later version of the plugin if available, or disable the plugin if not needed. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog (KEV) as per available data.