External risk intelligence

WordPress Web to Print Designer Arbitrary File Upload Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-82187

This vulnerability affects a WordPress plugin used for web-based design and file uploads. Such plugins are typically deployed on public-facing websites to allow user interaction, making the functionality inherently reachable from the internet as part of the standard deployment pattern for web applications.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts a WordPress plugin for online design, allowing unauthenticated users to upload and execute malicious files on the server. This could potentially compromise the integrity and availability of the affected website and its underlying infrastructure.

File upload flaw in a design plugin.
Allows unauthenticated remote code execution.
Confirm exposure and assess relevance.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload arbitrary files, such as PHP scripts, by exploiting a flaw in the Web to Print Online Designer WordPress plugin. This occurs because the plugin fails to properly check file types and extensions, and it also exposes the token that protects these uploads to anyone. Successful exploitation could lead to the attacker running their own code on the server.

No authentication required to interact.
Upload arbitrary files to the server.
Achieve remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability exists in the Web to Print Online Designer WordPress plugin that could allow unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, to the server. This could lead to the execution of arbitrary code, potentially compromising the server's integrity and data.

Arbitrary file uploads, including PHP.
Unauthenticated users can upload files.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Web to Print Online Designer WordPress plugin impacts organizations using this tool for web-based design and file uploads. The first practical step is for the website's infrastructure or platform team to identify all instances of the affected plugin, determine their reachability and criticality, and then work with the application owner to plan remediation.

Website owners and platform teams should lead remediation.
Verify affected plugin instances and their exposure.
Plan remediation based on identified risk and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Web to Print Online Designer plugin?

It is a WordPress extension designed to provide web-based design tools. Websites use it to allow visitors to create custom graphics or layouts and upload files directly to the server as part of the creative process.

What is the weakness class for CVE-2026-82187?

This vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434). It means the software does not properly filter or verify the files people upload, allowing malicious scripts to be placed where they can be executed by the server.

How does an attacker trigger this vulnerability?

An attacker triggers this by submitting a file to the plugin without needing an account or login. The bug occurs because the software fails to check file extensions and insecurely shares the security token meant to protect uploads. Simply viewing a page that does not utilize the file upload function will not trigger this.

Is this CVE relevant to my public-facing website?

Yes, Halo Surface Signal identifies this as highly relevant for public-facing sites. Because the plugin is designed for user interaction via web-based design, it is almost always deployed where it can be reached directly from the internet, making it an accessible target.

What are the first steps to address this issue?

Your infrastructure or platform team should first audit the environment to locate all active installations of this specific plugin. Once identified, evaluate how essential the plugin is to your operations and coordinate with the application owners to plan for disabling the feature or applying available updates.

References

wpscan.com/vulnerability/d3e49486-6c08-41d5-86c9-3aaff670fc63/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.