CVE-2016-20075: WordPress Ultimate Product Catalog RCE

CVE-2016-20075 Overview

CVE-2016-20075 is an arbitrary file upload vulnerability in the WordPress Ultimate Product Catalog plugin version 3.8.6. The flaw resides in the plugin's custom fields functionality, specifically the custom file field exposed through the Products tab. Authenticated users with contributor, editor, author, or administrator roles can abuse this functionality to upload PHP shells. Uploaded files land in the upcp-product-file-uploads directory and remain directly accessible over HTTP, enabling remote code execution on the underlying server. The issue is tracked under [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated low-privilege WordPress users can upload PHP shells through the Ultimate Product Catalog plugin and execute arbitrary code on the host.

Affected Products

WordPress Ultimate Product Catalog plugin version 3.8.6
WordPress installations using the affected plugin version with contributor-or-higher user accounts
Etoile Web Design Ultimate Product Catalog component

Discovery Timeline

2026-06-15 - CVE-2016-20075 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20075

Vulnerability Analysis

The Ultimate Product Catalog plugin exposes a custom file field within the Products tab of the WordPress administration interface. Any user role permitted to create or edit posts, including contributors, authors, editors, and administrators, can interact with this field. The plugin accepts uploaded files without enforcing extension allowlists or content-type validation. Uploaded artifacts are written to the upcp-product-file-uploads directory beneath the WordPress uploads path. Because this directory remains web-accessible, an attacker can browse directly to an uploaded .php file and trigger server-side execution. This converts a low-privilege authenticated session into full code execution under the web server account, typically resulting in compromise of the WordPress database, theme files, and any co-hosted sites.

Root Cause

The root cause is incorrect authorization combined with missing file-type validation. The plugin treats the file upload handler as available to any role with post-creation rights, despite the security implication of arbitrary file writes. No allowlist of safe MIME types or extensions is enforced, and the destination directory lacks execution restrictions. Together these design choices permit a contributor-level account to drop and execute server-side scripts.

Attack Vector

Exploitation requires an authenticated WordPress session with at least the contributor role. The attacker navigates to the Products tab, selects the custom file field, and uploads a crafted PHP payload. The plugin saves the file to wp-content/uploads/upcp-product-file-uploads/ using a predictable name. The attacker then issues an HTTP GET request to the resulting URL, causing the PHP interpreter to execute the shell. From this foothold, the attacker can pivot to host enumeration, credential theft, and lateral movement. Public exploitation details are documented in Exploit-DB #40012 and the VulnCheck advisory. The current EPSS probability stands at 0.327% (24.3 percentile), reflecting limited observed exploitation despite the publicly available proof of concept.

No sanitized exploit code is reproduced here. Refer to the referenced advisories for the full upload request structure and payload examples.

Detection Methods for CVE-2016-20075

Indicators of Compromise

Presence of .php, .phtml, or .phar files inside the wp-content/uploads/upcp-product-file-uploads/ directory
Unexpected outbound connections originating from the PHP-FPM or Apache worker process following a file upload
New or modified WordPress administrator accounts created shortly after a contributor or author session
Web server access logs showing POST requests to admin-ajax.php or post.php followed by GET requests to files under upcp-product-file-uploads

Detection Strategies

Monitor the WordPress uploads tree for files whose extensions do not match the configured allowlist for media assets
Alert on web server execution of scripts from any path containing upcp-product-file-uploads
Correlate WordPress audit logs of contributor or author logins with subsequent file system writes under wp-content/uploads

Monitoring Recommendations

Enable file integrity monitoring across wp-content/uploads with alerts for newly created executable script files
Forward web server access logs and PHP error logs to a central analytics platform for retroactive hunting
Track WordPress role assignments and flag accounts elevated to contributor or higher outside of change windows

How to Mitigate CVE-2016-20075

Immediate Actions Required

Upgrade the Ultimate Product Catalog plugin to the latest vendor release that addresses this issue, or remove the plugin if no fixed version is available from Etoile Web Design
Audit all files in wp-content/uploads/upcp-product-file-uploads/ and remove any non-media artifacts
Rotate WordPress administrator credentials and review user roles for unexpected contributor, author, or editor accounts

Patch Information

Review the VulnCheck advisory and the vendor site at Etoile Web Design for the latest fixed version. If a patched release is unavailable, uninstall the plugin and replace it with a maintained alternative.

Workarounds

Restrict PHP execution within the wp-content/uploads directory using web server configuration directives
Limit user role provisioning so untrusted accounts cannot be assigned contributor or higher
Place the WordPress administration interface behind network-level authentication such as IP allowlisting or a VPN

bash

# Apache: block PHP execution under the uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent for the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}