VulnSocial

CVE-2026-103889

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 3 mentions (2026-10-11); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-10-11: 3Mentions · 2026-10-12: 110-1110-12
Referenced assets1 URL
By indicator
Full discourse4 posts
  • Rıdvan Yağlı@ridvanyagli

    🚨 8–12 Ekim 2026 tarihlerinde yayınlanan WooCommerce Core ve eklentilere ait güvenlik açıkları: 🔴 CVE-2026-103889 — CVSS 9.8 (CRITICAL) 3D Product Configurator for WooCommerce: Kimlik doğrulaması gerektirmeyen uzaktan kod çalıştırma (RCE) açığı. 🔴 CVE-2026-42718 — CVSS 9.8 (CRITICAL) Booster for WooCommerce: PHP Object Injection açığı; uygun koşullarda sunucu tarafında ciddi güvenlik ihlaline yol açabilir. 🔴 CVE-2026-104801 — CVSS 9.1 (CRITICAL) PPOM for WooCommerce: Kimlik doğrulaması gerektirmeyen keyfî dosya silme açığı. 🟠 CVE-2026-106608 — CVSS 7.2 (HIGH) WooCommerce çekirdeği: Shop Manager ve üzeri yetki düzeyleriyle ilişkili yetki yükseltme açığı. 🟠 CVE-2026-93746 — CVSS 7.5 (HIGH) WooCommerce PDF Invoices: Sipariş belgelerine yetkisiz erişime neden olabilecek IDOR açığı. 🟠 CVE-2026-62130 — CVSS 7.2 (HIGH) WooCommerce Multilingual & Multicurrency: PHP Object Injection açığı. 🛡️ İlgili eklentileri ve WooCommerce çekirdek sürümünü kontrol edin; etkilenen sürümleri üreticilerin yayınladığı güncel sürümlere yükseltin.

    00071500
    2.4K followersView on X
  • ExploitGrid@exploitgrid

    ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-42696 (CVSS: 10) CVE-2026-62024 (CVSS: 9.9) CVE-2026-62129 (CVSS: 9.9) CVE-2026-103889 (CVSS: 9.8) expivi CVE-2026-104398 (CVSS: 9.8) VillaTheme ..🧵👇

    11033255
    385 followersView on X
  • ExploitGrid@exploitgrid

    ├ CVE-2026-62129 · WP Creator LMS ≤1.2.21 · Arbitrary file upload (9.9) ├ CVE-2026-103889 · expivi 3D Product Configurator for WooCommerce ≤2.16.2 · Unauth RCE (9.8) └ CVE-2026-104398 · VillaTheme AFFI Affiliate Marketing for WooCommerce ≤1.0.10 · PHP object injection (9.8)

    1001052
    385 followersView on X
  • ExploitGrid@exploitgrid

    [CVE] CVE-2026-103889 [HIGH PRIORITY] CVSS: 9.8 | Vendor: #expivi #3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Co... 🔗 https://exploitgrid.net/cve/CVE-2026-103889

    1000035
    385 followersView on X

Explore more

Back to dashboard