CVE-2016-20075

Name of the Vulnerable Software and Affected Versions WordPress Ultimate Product Catalog version 3.8.6

Description An arbitrary file upload issue exists that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the custom file field in the Products tab and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.