Critical RCE Vulnerability Found in 3D Product Configurator for WooCommerce Plugin
Unauthenticated attackers can execute arbitrary code on WordPress sites using the vulnerable 3D Product Configurator plugin due to missing security checks.
Key points
- CVE-2026-103889 is rated 9.8 Critical by the NVD.
- The flaw allows remote code execution via the 'xpv_image' parameter.
- Versions up to and including 2.16.2 of the expivi plugin are affected.
- Authentication and nonce checks are disabled via a code comment.
A critical remote code execution vulnerability has been identified in the 3D Product Configurator for WooCommerce plugin for WordPress, affecting all versions up to and including 2.16.2. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable servers.
At a glance
- CVE
- CVE-2026-103889
- Product
- expivi 3D Product configurator for WooCommerce
- CVSS
- 9.8 Critical
- Weakness
- unrestricted file upload
- Exploited
- No known exploitation
The National Vulnerability Database (NVD) has assigned the issue CVE-2026-103889 and rated it a CVSS score of 9.8, classifying it as Critical. The vulnerability stems from missing authentication and nonce checks on the wp_loaded handler. Additionally, the application fails to sanitize the 'xpv_image' POST parameter before echoing it unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This combination of flaws permits an attacker to run code on the server without needing valid credentials.
Context and Background
The security failure is rooted in how the plugin handles incoming requests. According to the NVD record, the only nonce and authentication check present in the handler is entirely enclosed in a block comment. There is no replacement code for this check, leaving the endpoint fully exposed.
An attacker can exploit this by sending a single unauthenticated POST request to any URL on the site. Because the 'xpv_image' parameter is not sanitized and is passed directly into a template that executes PHP, the server processes the malicious input as code. This bypasses standard WordPress security measures that typically protect against unauthorized access and injection attacks.
Who Is Affected
The vulnerability affects websites using the 3D Product Configurator for WooCommerce plugin developed by expivi. All versions of the plugin up to and including 2.16.2 are vulnerable. Sites running version 2.16.2 or earlier are at immediate risk if the plugin is active and accessible to the public internet.
WordPress administrators should verify their plugin versions immediately. Because the exploit requires no authentication, automated scanning tools or malicious actors can target these sites without prior access. The weakness is categorized under CWE-434, which relates to unrestricted upload of executable file, though the specific mechanism here involves parameter injection leading to code execution.
What should you do?
No patch or fix has been confirmed yet for this vulnerability. Site administrators should monitor for an official update from the vendor. Until a fix is available, reducing exposure is the primary mitigation strategy.
What to do and how to stay safe: WordPress
- Audit your WordPress installation to check if the 3D Product Configurator for WooCommerce plugin is installed and active.
- If the plugin is not essential to your site’s operation, consider disabling or removing it to eliminate the attack surface.
- Monitor server logs for unusual POST requests to any URL on the site, particularly those containing the 'xpv_image' parameter.
- Restrict access to the WordPress admin area and ensure server-side firewalls are configured to block suspicious traffic patterns.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-103889?
It is a critical remote code execution vulnerability in the 3D Product Configurator for WooCommerce plugin, rated 9.8 by the NVD.
Which versions of the plugin are affected?
All versions of the 3D Product Configurator for WooCommerce plugin up to and including 2.16.2 are affected.
Do attackers need a login to exploit this?
No, the vulnerability allows unauthenticated attackers to execute code by sending a single POST request.
