A critical vulnerability in the Web to Print Online Designer WordPress plugin allows unauthenticated remote code execution, posing an immediate threat to server integrity.

This vulnerability, classified as CWE-434, stems from a failure to validate file extensions during the upload process. An unauthenticated attacker can obtain the necessary upload token and upload malicious PHP files, leading to full remote code execution on the underlying server.

The CVSS score of 9.8 reflects the critical nature of this flaw, as it requires no authentication and allows complete system compromise. A successful exploit could lead to full unauthorized access to the web server, potential data exfiltration, and the establishment of persistent backdoors, which would cause significant operational disruption and reputational damage.

Immediate Action: Update the Web to Print Online Designer plugin to version 2.15.0 or later immediately.

Proactive Monitoring: Review web server access logs for unusual file upload activity or requests directed at non-standard directories where plugin uploads are stored.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized file uploads and restrict access to common plugin upload paths until the update is applied.

Public Exploit Available: No (exploit_available unknown)

This vulnerability represents a critical security risk that requires urgent attention. Administrators must prioritize updating the Web to Print Online Designer plugin to version 2.15.0 across all environments to eliminate the risk of remote code execution. Failure to patch allows any visitor to gain full control over the application server.