Authenticated code execution via client-side upload validation
Published May 16, 2026 · Updated May 16, 2026
Unrestricted file upload in HS Brand Logo Slider 2.1 allows remote authenticated users to execute code through a crafted logo upload. The plugin's admin.php page relies on client-side extension validation for the logoupload filename, so an intercepted multipart request can replace an image extension with .php. An authenticated WordPress account with access to the plugin's administrative upload interface is required, and execution occurs when the web server serves the uploaded PHP shell.
Summary
What happened
Unrestricted file upload in HS Brand Logo Slider 2.1 allows remote authenticated users to execute code through a crafted logo upload. The plugin's admin.php page relies on client-side extension validation for the logoupload filename, so an intercepted multipart request can replace an image extension with .php. An authenticated WordPress account with access to the plugin's administrative upload interface is required, and execution occurs when the web server serves the uploaded PHP shell.
The record
- CVE
- CVE-2020-37227
- Published
- May 16, 2026
- Updated
- May 16, 2026
- Vendor
- Helios Solutions
- Product
- HS Brand Logo Slider
- Classifications
- CWE-434, T1505.003
- Attack vector
- network
- Privileges
- authenticated
Timeline
How it unfolded
- May 16, 2026CVE publishedPublication date reported by the CVE source.
- May 16, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=2.1
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- WordPress Plugin HS Brand Logo Slider 2.1 - 'logoupload' File Uploadfunctional · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo