VulnSocial

CVE-2026-82187Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-21); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-09-21: 2Mentions · 2026-09-22: 2Patch / Workaround · 2026-09-21: 1Technical Details · 2026-09-21: 2Technical Details · 2026-09-22: 109-2109-22
Signal classification2 categories
Disclosure
375.0%
Patch
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-212
Disclosure1Patch1
2026-09-222
Disclosure2
Full discourse4 posts
  • CVE@CVEnew
    Patch

    CVE-2026-82187 The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those upload… https://www.cve.org/CVERecord?id=CVE-2026-82187

    Post summary

    The text discloses an unrestricted file upload vulnerability (CVE-2026-82187) in the Web to Print Online Designer WordPress plugin prior to version 2.15.0, with the fix implied by the version cutoff; the post is truncated so full technical and remediation details are incomplete.

    000111.2K
    58.1K followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    [CVE] CVE-2026-82187 [HIGH PRIORITY] #WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitr... 🔗 https://exploitgrid.net/cve/CVE-2026-82187

    Post summary

    The tweet announces CVE-2026-82187 affecting WooCommerce Online Product Designer versions 1.7.0 to <2.15.0, noting an unauthenticated arbitrary vulnerability, and provides a link to exploitgrid.net for further details.

    1000041
    203 followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-77521 CVE-2026-79920 CVE-2026-82187 CVE-2026-85751 CVE-2026-94301 ..🧵👇

    Post summary

    The tweet is a daily threat digest that only lists five CVE identifiers without any technical details, PoCs, exploit tools, patches, or exploitation status.

    1000055
    203 followersView on X
  • NewNormal Security@NewScanTeam
    Disclosure

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 21 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🔗 Host-header injection — the app builds its own download and asset links from a header you send, so every link can be aimed at the attacker (Eclipse Open VSX CVE-2025-12999) 📦 Unauthenticated file upload in a vulnerable plugin build — any visitor uploads a script and runs code (WooCommerce Online Product Designer CVE-2026-82187) 📦 Vulnerable WordPress plugin builds — shortcode injection, client-set order prices, unauthenticated import (GiveWP CVE-2026-85113, RestroPress CVE-2026-85010, To Do List Member CVE-2026-86802) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #HostHeaderInjection #CSO #REDTEAM

    Post summary

    NewNormal Security published a daily CVE report for September 21 2026, detailing several newly detected vulnerabilities—including a host‑header injection, an unauthenticated file upload, and WordPress plugin issues—providing brief technical descriptions of each.

    0000067
    6 followersView on X

Explore more

Back to dashboard