CVE-2026-82187 WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload
Unauthenticated attackers can upload arbitrary files, including PHP, to execute code on the server due to missing validation in the Web to Print Online Designer plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82187?
CVE-2026-82187 is a critical vulnerability in Unknown Web to Print Online Designer, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.
Weakness: CWE-434
Which versions are affected by CVE-2026-82187?
How do I fix CVE-2026-82187?
No fix has been published for CVE-2026-82187 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82187 being exploited?
There is no known exploitation of CVE-2026-82187 in the wild and no public exploit code.
Sources
Also known as GHSA-hcgg-qj5x-56wj.