Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-82187

WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-82187

Published

The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-82187

Published

Web to Print Online Designer

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Web to Print Online Designer",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "1.7.0",
                            "lessThan": "2.15.0"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON