Executive brief
The Teddy Bear Customize Addon is a WordPress plugin used to customize teddy bear products. The plugin fails to properly validate file uploads, allowing unauthenticated attackers to upload malicious PHP files and execute arbitrary code on the web server, potentially compromising the entire WordPress site and customer data.
Technical details
The vulnerability is a classic arbitrary file upload vulnerability (CWE-94) in the plugin's file upload handler. The plugin relies solely on client-supplied content type headers and preserves the original filename without proper validation or filtering. This allows unauthenticated attackers to bypass security controls by uploading PHP files with spoofed MIME types. No authentication is required; the upload endpoint is publicly accessible. Successful exploitation results in remote code execution with web server privileges. There is no known patch as of the advisory date.
Affected products
- WordPress Teddy Bear Customize Addon through 1.0.5
Timeline
- 2026-09-09: disclosed
- 2026-09-11: advisory