WordPress Ultimate Product Catalog Arbitrary File Upload

WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2016-20075 is an arbitrary file upload vulnerability in WordPress Ultimate Product Catalog plugin version 3.8.6 that allows authenticated users with contributor, editor, author, or administrator roles to bypass file type restrictions. By exploiting the custom fields functionality in the Products tab, attackers can upload malicious PHP files disguised as product attachments, which are then stored in the publicly accessible upcp-product-file-uploads directory. This vulnerability is particularly dangerous because it requires only basic authenticated access—a compromised low-privilege account or social engineering can grant an attacker the ability to execute arbitrary code on the server. Any WordPress site running this plugin version with user roles enabled is at risk of complete server compromise.

Casky's 261 matching skills detect the attack patterns associated with this CVE by mapping to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe skill findings that identify suspicious file upload activity to the upcp-product-file-uploads directory, particularly PHP or executable files uploaded through the custom fields feature. Claude's extended reasoning capabilities help correlate role-based access patterns with file upload attempts, detecting when contributor or editor-level accounts perform atypical file operations. Security teams would see detailed findings highlighting the exploit chain: authenticated user accessing custom field upload functionality, file persistence in web-accessible directories, and potential web shell execution patterns—enabling them to identify compromise attempts before code execution occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2016-20075.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2016-20075

Casky has 261 skills that investigate the attack patterns behind CVE-2016-20075. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn