CVE-2026-103889 json
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
published 30d ago modified 27d ago also EUVD-2026-96055
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.
Is CVE-2026-103889 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 29d ago
Exploit prediction
1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- expivi 3D Product configurator for WooCommerce
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/46f69f7b-6d9b-494d-b123-63fc5ebcb6f3?source=cve
- plugins.trac.wordpress.org /browser/expivi/tags/2.16.2/templates/pdf/pdf-configuration-details.phtml#L199
- plugins.trac.wordpress.org /browser/expivi/tags/2.16.2/classes/woocommerce/class-expivi-cart-manager.php#L238
- plugins.trac.wordpress.org /browser/expivi/tags/2.16.2/classes/woocommerce/class-expivi-cart-manager.php#L212
- plugins.trac.wordpress.org /browser/expivi/tags/2.16.2/classes/woocommerce/class-expivi-cart-manager.php#L95
- plugins.trac.wordpress.org /browser/expivi/tags/2.16.2/classes/pdf/class-pdf.php#L34
- plugins.trac.wordpress.org /browser/expivi/tags/2.16.2/classes/woocommerce/class-expivi-cart-manager.php#L598
- plugins.trac.wordpress.org /changeset?reponame=&old=3723323%40expivi&new=3723323%40expivi
Sources
- CVE List CVE-2026-103889
- NVD CVE-2026-103889
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.