WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE

Published 4 mo ago 2026-06-15 · modified 3 mo ago 2026-07-15 · JSON

CVSS

8.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.3%

percentile 25%

Public exploits

none known

WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: total
Assessed: 4 mo ago 2026-06-15

Exploit prediction (EPSS)

0.32% probability of exploitation in the next 30 days, higher than 25% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	8.7	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
CNA	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CNA	4.0	8.7	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Etoilewebdesign Ultimate Product Catalog

Classification

Weakness

CWE-863 Incorrect Authorization

References

exploit-db.com /exploits/40012 · exploit
etoilewebdesign.com / · product
vulncheck.com /advisories/wordpress-ultimate-product-catalog-arbitrary-file-upload-rce · third-party-advisory

Sources

CVE List: CVE-2016-20075
NVD: CVE-2016-20075

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary