# CVE-2016-20075: Etoile Web Design Ultimate Product Catalog arbitrary file upload in custom fields

Source: https://junglewise.ai/threats/cve-2016-20075-etoile-web-design-ultimate-product-catalog-arbitrary-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2016-20075 · Severity: high · CVSS 8.8 · Published 2026-06-15

The Ultimate Product Catalog plugin for WordPress, which is used to manage and display product listings, contains a security flaw in its file upload system. An authorized user with basic permissions (such as a contributor or author) can upload malicious files, including web shells, to the server. This could allow an attacker to take complete control of the website, access sensitive data, or disrupt business operations.

Vendors: [Etoile Web Design](https://junglewise.ai/threats/vendors/etoile-web-design).

## Quick answers

**Is CVE-2016-20075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-20075 being exploited in the wild.

**How severe is CVE-2016-20075?** High severity, with a CVSS score of 8.8, published 15 June 2026.

**Which products and versions are affected?** Etoile Web Design Ultimate Product Catalog <= 3.8.6.

**Is there a fix for CVE-2016-20075?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-20075 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-20075?** Check whether you run Etoile Web Design Ultimate Product Catalog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An arbitrary file upload vulnerability exists in the WordPress Ultimate Product Catalog plugin (v3.8.6 and below) due to insufficient file extension validation in the UPCP_Handle_File_Upload function within Update_Admin-Databases.php. The flaw is exploitable by authenticated users with roles ranging from Contributor to Administrator. By creating a custom field of type 'file' and attaching a malicious PHP script to a product, an attacker can upload a web shell to the /wp-content/uploads/upcp-product-file-uploads/ directory. Since the plugin does not restrict file types or sanitize extensions, the uploaded script can be executed remotely, leading to full Remote Code Execution (RCE). The vulnerability specifically affects the premium version of the plugin where custom fields are enabled.

## Affected products

- Etoile Web Design Ultimate Product Catalog <= 3.8.6

## Timeline

- 2015-08-08: other: Vulnerability discovered
- 2016-06-21: disclosed: Reported to vendor (no response)
- 2016-06-24: advisory: Public disclosure via Exploit-DB
- 2026-06-15: advisory: NVD/VulnCheck advisory published

## References

- [http://www.etoilewebdesign.com/](http://www.etoilewebdesign.com/)
- [https://www.exploit-db.com/exploits/40012](https://www.exploit-db.com/exploits/40012)
- [https://www.vulncheck.com/advisories/wordpress-ultimate-product-catalog-arbitrary-file-upload-rce](https://www.vulncheck.com/advisories/wordpress-ultimate-product-catalog-arbitrary-file-upload-rce)

## Related threats

- [Etoile Web Design Ultimate Product Catalog stored XSS in price parameter](https://junglewise.ai/threats/cve-2021-47924-etoile-web-design-ultimate-product-catalog-stored-xss-in-price)