PatchSiren cyber security CVE debrief
CVE-2016-20075 Etoilewebdesign CVE debrief
CVE-2016-20075 is a high-severity vulnerability in the WordPress Ultimate Product Catalog plugin, specifically in version 3.8.6. The vulnerability allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server. The CVSS score for this vulnerability is 8.7, indicating a high severity.
- Vendor
- Etoilewebdesign
- Product
- Ultimate Product Catalog
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-15
- Original CVE updated
- 2026-06-15
- Advisory published
- 2026-06-15
- Advisory updated
- 2026-06-15
Who should care
Users of the WordPress Ultimate Product Catalog plugin, particularly those with contributor, editor, author, or administrator roles, should be aware of this vulnerability and take necessary precautions.
Technical summary
The vulnerability is caused by a lack of proper validation and sanitization of user-uploaded files. An attacker can exploit this vulnerability by uploading a malicious PHP file through the custom file field in the Products tab. The uploaded file can then be accessed via the upcp-product-file-uploads directory, allowing the attacker to execute arbitrary code on the server.
Defensive priority
High
Recommended defensive actions
- Update the WordPress Ultimate Product Catalog plugin to a version that fixes the vulnerability.
- Restrict access to the Products tab custom file field to only trusted users.
- Monitor the upcp-product-file-uploads directory for suspicious files.
Evidence notes
The CVE record for CVE-2016-20075 can be found at [cve-org]. The NVD detail for this vulnerability can be found at [nvd]. Additional information can be found at [ref-4], [ref-5], and [ref-6].
Official resources
CVE-2016-20075 was published on 2026-06-15T14:16:30.803Z and has not been modified since then.