Web To Print Online Designer
Monthly
Unauthenticated arbitrary file upload in the Web to Print Online Designer WordPress plugin (versions 1.7.0 through before 2.15.0) allows any remote visitor to obtain the token that protects the plugin's upload handler and then push arbitrary files, including PHP scripts, into a web-reachable location - resulting in remote code execution with total confidentiality, integrity, and availability impact (CVSS 9.8). No authentication, user interaction, or non-default configuration is required; the plugin simply fails to validate file type or extension and discloses the upload token to anonymous requesters. Publicly available exploit code exists, so weaponization against exposed installations is a realistic short-term risk, although the vendor (WPScan-reported) has shipped a fix in 2.15.0 and EPSS currently rates near-term exploitation probability low at 0.14% (4th percentile), tracking the plugin's comparatively small install base.
Unauthenticated arbitrary file upload in the Web to Print Online Designer WordPress plugin (versions 1.7.0 through before 2.15.0) allows any remote visitor to obtain the token that protects the plugin's upload handler and then push arbitrary files, including PHP scripts, into a web-reachable location - resulting in remote code execution with total confidentiality, integrity, and availability impact (CVSS 9.8). No authentication, user interaction, or non-default configuration is required; the plugin simply fails to validate file type or extension and discloses the upload token to anonymous requesters. Publicly available exploit code exists, so weaponization against exposed installations is a realistic short-term risk, although the vendor (WPScan-reported) has shipped a fix in 2.15.0 and EPSS currently rates near-term exploitation probability low at 0.14% (4th percentile), tracking the plugin's comparatively small install base.