CVE-2026-82187

COMPONENT VERSION RANGE

NewScan fingerprints web-to-print-online-designer from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-21. Directory slug `web-to-print-online-designer`, plugin title 'WooCommerce Online Product Designer' - the two differ, and the SLUG is what scan_wordpress keys on, so do not rename this key to the title. Range 1.7.0 -> <2.15.0 and fixed_in are ground truth from the WPScan entry (d3e49486-6c08-41d5-86c9-3aaff670fc63), not from the CVE prose, which carries a 0.0 placeholder score. Two flaws compose into pre-auth RCE: the designer's upload handler validates neither the MIME type nor the extension, and the token that is supposed to protect those uploads is emitted to unauthenticated visitors - so the token is not a precondition an attacker has to satisfy. `ge` 1.7.0 is deliberate: the vulnerable upload handler was introduced in 1.7.0 and earlier releases would otherwise be flagged for a code path they do not ship. Observation source is the readme.txt `Stable tag:` probe scan_wordpress already walks for `requires: wordpress-plugin` rows - this plugin is not in the wordpress.org directory (api.wordpress.org 404s the slug, it ships via CodeCanyon/vendor), so the asset-?ver= route alone would have been unreliable and the readme probe is what makes the row reachable. Version-match only, deliberately: proving it means writing a PHP file into the customer's uploads directory.